---
id: CVE-2026-123580
title: >-
  Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via
  NSEC3
summary: >-
  Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through
  0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC
  verification, comparing only the hashed label without confirming the record
  belo…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-290
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns >= 0.26.0-beta.1 < 0.26.2
  - hickory-dns <= 0.26.0-alpha.1
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:14.779Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123580'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4
    label: GitHub Security Advisory (GHSA-p2jv-r3m3-7wf4)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-nonexistence-proof-forgery-via-nsec3
    label: >-
      VulnCheck Advisory: Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC
      Nonexistence Proof Forgery via NSEC3
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.652Z'
---

## Overview

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.

## Affected

- `hickory-dns >= 0.26.0-beta.1 < 0.26.2`
- `hickory-dns <= 0.26.0-alpha.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.