EUVD-2026-119340Published
Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-123581 · CVE overview and exploitation status
cve-program · CVE-2026-123581
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj
- https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset
euvd · EUVD-2026-119340
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj
- https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset
nvd · CVE-2026-123581
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj
- https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset
osv · RUSTSEC-2026-0512
- https://crates.io/crates/hickory-proto
- https://rustsec.org/advisories/RUSTSEC-2026-0512.html
- https://github.com/hickory-dns/hickory-dns/commit/77ec9c5d2e9481a0753bbaf1be3cd5175d300cff
osv · RUSTSEC-2026-0520
Related changes
Linked by CVE identifier- Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking … · Advisory content revised · 14 Nov 2026
- DNSSEC validation accepted an unrelated signed RRset as the answer (hickory-proto) · Newly collected advisory · 12 Nov 2026
- DNSSEC validation accepted a validly signed but unrelated RRset as the answer · Newly collected advisory · 12 Nov 2026
- Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset · Newly collected advisory · 8 Nov 2026