CVE-2026-123580High· 7.5▾ TwilightHickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.
hickory-dns >= 0.26.0-beta.1 < 0.26.2hickory-dns <= 0.26.0-alpha.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123578Low· 3.7Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0
CVE-2026-123587Medium· 6.8Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC
CVE-2026-123576High· 7.5Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
CVE-2026-123571High· 7.5Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
CVE-2026-123572High· 7.5Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser
CVE-2026-123570High· 7.5Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts