ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-123587

Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC

CVSS 4.0 8.9 HIGHCVSS 3.1 6.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 8 Nov 2026 03:06:35 UTC. Read the latest advisory.

cve-program · CVE-2026-123587

Published

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-123587

Published

hickory-dns

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "hickory-dns",
                    "product": "hickory-dns",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:cargo/hickory-net",
                    "versions": [
                        {
                            "version": "0.26.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "0.26.2"
                        },
                        {
                            "version": "0.26.2",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON