---
id: CVE-2026-123581
title: >-
  Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated
  RRset
summary: >-
  Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1
  before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a
  positive answer when any valid RRset appears in the answer section, without
  checki…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-345
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns <= 0.26.0-alpha.1
  - hickory-dns >= 0.26.0-beta.1 < 0.26.2
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:15.448Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123581'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj
    label: GitHub Security Advisory (GHSA-929p-gjf6-5hqj)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset
    label: >-
      VulnCheck Advisory: Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation
      Bypass via Unrelated RRset
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.651Z'
---

## Overview

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.

## Affected

- `hickory-dns <= 0.26.0-alpha.1`
- `hickory-dns >= 0.26.0-beta.1 < 0.26.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.