{"id":"RUSTSEC-2026-0512","revision":null,"records":[{"revision":"2df0f257193d43369c15feb350595264","observedAt":"2026-11-10T19:21:22.605+00:00","statement":{"source":"cve-program","id":"CVE-2026-123581","aliases":[],"title":"Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","state":0,"publishedAt":"2026-11-08T01:38:15.448+00:00","modifiedAt":"2026-11-10T17:57:50.919+00:00","affected":[{"ecosystem":"Vendor product","name":"hickory-dns","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"hickory-dns\",\n                    \"product\": \"hickory-dns\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/hickory-proto\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"0.26.0-alpha.1\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"hickory-dns","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"hickory-dns\",\n                    \"product\": \"hickory-dns\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/hickory-net\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.26.0-beta.1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.26.2\"\n                        },\n                        {\n                            \"version\": \"0.26.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj","https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123581","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-123581","identifiers":["CVE-2026-123581"]},"retained":false,"historicalAffected":[]},{"revision":"41c7f9fb9d03483fbbcd204f7ce67deb","observedAt":"2026-11-12T15:19:03.185+00:00","statement":{"source":"euvd","id":"EUVD-2026-119340","aliases":["CVE-2026-123581","GHSA-6w9h-68h2-v6xq"],"title":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking …","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj","https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119340","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 8, 2026, 1:38:15 AM","dateUpdated":"Nov 10, 2026, 5:57:50 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-119340","identifiers":["EUVD-2026-119340","CVE-2026-123581","GHSA-6w9h-68h2-v6xq"]},"retained":false,"historicalAffected":[]},{"revision":"0a62e7dd7d9e4a1b946cbc19efcb6d1b","observedAt":"2026-11-12T15:18:38.266+00:00","statement":{"source":"nvd","id":"CVE-2026-123581","aliases":[],"title":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking …","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","state":0,"publishedAt":"2026-11-08T02:16:51.693+00:00","modifiedAt":"2026-11-10T22:15:59.797+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj","https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-123581","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-345"],"productCriteria":[],"sourceDates":{"published":"2026-11-08T02:16:51.693","lastModified":"2026-11-10T22:15:59.797"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-123581","identifiers":["CVE-2026-123581"]},"retained":false,"historicalAffected":[]},{"revision":"bb01ba5ce75e48d6ae70b27abb8cbdc2","observedAt":"2026-11-12T15:18:33.301+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0512","aliases":["CVE-2026-123581","GHSA-929p-gjf6-5hqj","RUSTSEC-2026-0520"],"title":"DNSSEC validation accepted an unrelated signed RRset as the answer (hickory-proto)","description":"Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation treated a response with a non-empty answer section as a positive answer if its records validated, without checking that any of them matched the queried name and type. Someone who can answer or modify DNS responses could return a genuine signed RRset for another name or type and have it accepted as a validated answer.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","state":0,"publishedAt":"2026-09-03T12:00:00+00:00","modifiedAt":"2026-11-12T14:40:54.6459758+00:00","affected":[{"ecosystem":"crates.io","name":"hickory-proto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.26.0-beta.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/hickory-proto","https://rustsec.org/advisories/RUSTSEC-2026-0512.html","https://github.com/hickory-dns/hickory-dns/commit/77ec9c5d2e9481a0753bbaf1be3cd5175d300cff"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0512","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0512","identifiers":["RUSTSEC-2026-0512","CVE-2026-123581","GHSA-929p-gjf6-5hqj","RUSTSEC-2026-0520"]},"retained":false,"historicalAffected":[]},{"revision":"f8bc102d4b374d92bca22ccfda6fc133","observedAt":"2026-11-12T15:18:33.301+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0520","aliases":["CVE-2026-123581","GHSA-929p-gjf6-5hqj","RUSTSEC-2026-0512"],"title":"DNSSEC validation accepted a validly signed but unrelated RRset as the answer","description":"When a response had a non-empty answer section, DNSSEC validation treated it as a positive answer as long as the records in it validated. It did not check that any of those records had the queried name and either the queried type or type CNAME.\n\nAn attacker who can answer or modify DNS responses can therefore return a genuine, signed RRset for some other name or type, and have it accepted as a validated answer to the query instead of being handled as a response with no matching data.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix requires at least one answer record that matches the query name and is either of the queried type or a CNAME, both for positive responses and when NSEC records are checked. It is in 0.26.2.","state":0,"publishedAt":"2026-09-03T12:00:00+00:00","modifiedAt":"2026-11-12T14:40:54.6459758+00:00","affected":[{"ecosystem":"crates.io","name":"hickory-net","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.26.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/hickory-net","https://rustsec.org/advisories/RUSTSEC-2026-0520.html","https://github.com/hickory-dns/hickory-dns/commit/77ec9c5d2e9481a0753bbaf1be3cd5175d300cff"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0520","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0520","identifiers":["RUSTSEC-2026-0520","CVE-2026-123581","GHSA-929p-gjf6-5hqj","RUSTSEC-2026-0512"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T21:16:34.5730792+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T21:16:34.5730792+00:00","lastSuccessAt":"2026-11-12T21:16:34.7781818+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:34.7781851+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-203e202fbd67c0cbc347ba020411be78e9e154b4ca5912ba08a1c1b61a3b79e8","complete":true,"records":424847,"lastAttemptAt":"2026-11-12T21:16:24.9956006+00:00","lastSuccessAt":"2026-11-12T21:16:24.6892247+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:24.9956006+00:00","snapshotPublishedAt":"2026-11-12T20:19:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1253d9ed54bb4e1a8c191d635f5090a8","complete":true,"records":13780,"lastAttemptAt":"2026-11-12T21:17:25.2880474+00:00","lastSuccessAt":"2026-11-12T21:17:25.284+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:17:25.284+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13833,"expectedIdentifiers":13833,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T21:16:34.5730792+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-12T21:16:34.5730792+00:00","lastSuccessAt":"2026-11-12T21:16:34.7790575+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:34.7790576+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c7da84f937d546f9bc47709812462004","complete":false,"records":13780,"lastAttemptAt":"2026-11-12T21:17:00.3939011+00:00","lastSuccessAt":"2026-11-12T21:17:00.39+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:17:00.39+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13830,"expectedIdentifiers":13833,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0db4c534aaa8e6aa34cb4db66b1c3dbcd45a9d81a0f263fa9d438e08e81869b0","complete":true,"records":9952,"lastAttemptAt":"2026-11-12T21:16:34.5223929+00:00","lastSuccessAt":"2026-11-12T21:16:34.1869923+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:34.5223929+00:00","snapshotPublishedAt":"2026-11-12T21:03:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-12T21:16:25.0464832+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:25.0464832+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0d57668ba92a2918d0664e89ea91d467f8e6a2bc6330923eb883b74ac42a14ec","complete":true,"records":3125,"lastAttemptAt":"2026-11-12T21:16:34.5377517+00:00","lastSuccessAt":"2026-11-12T15:18:36.6112732+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:34.5377517+00:00","snapshotPublishedAt":"2026-11-12T14:48:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-aacb2ea0a84f684226fd5e421ed31635112d695f522f1d5914b6afab8cc7f03c","complete":true,"records":231724,"lastAttemptAt":"2026-11-12T21:16:25.1509038+00:00","lastSuccessAt":"2026-11-12T20:18:18.1230476+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:25.1509038+00:00","snapshotPublishedAt":"2026-11-12T19:33:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}