Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-123587 · CVE overview and exploitation status

EUVD-2026-119346

GHSA-2vx4-5gxp-vmjw

RUSTSEC-2026-0508

GHSA-qw83-5pm2-ggp5

cve-program · CVE-2026-123587

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5
• https://www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-dnssec-nonexistence-forgery-via-wraparound-nsec

euvd · EUVD-2026-119346

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5
• https://www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-dnssec-nonexistence-forgery-via-wraparound-nsec

nvd · CVE-2026-123587

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5
• https://www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-dnssec-nonexistence-forgery-via-wraparound-nsec

osv · RUSTSEC-2026-0508

• https://crates.io/crates/hickory-net
• https://rustsec.org/advisories/RUSTSEC-2026-0508.html
• https://github.com/hickory-dns/hickory-dns/commit/e5ca40a7ef149ba5a79bc6f4916f114d153ce9ab

• The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers… · Advisory content revised · 14 Nov 2026
• NSEC wraparound detection trusted an unvalidated SOA record · Newly collected advisory · 12 Nov 2026
• Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC · Newly collected advisory · 8 Nov 2026