---
id: CVE-2026-123590
title: >-
  Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature
  Validation
summary: >-
  Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through
  0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs
  when any other record with the same owner name passes signature validation.
  Attacke…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-347
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns >= 0.26.0-beta.1 < 0.26.2
  - hickory-dns <= 0.26.0-alpha.1
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:21.651Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123590'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6
    label: GitHub Security Advisory (GHSA-57pw-897j-v4j6)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-improper-nsec-nsec3-signature-validation
    label: >-
      VulnCheck Advisory: Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper
      NSEC/NSEC3 Signature Validation
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.648Z'
---

## Overview

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

## Affected

- `hickory-dns >= 0.26.0-beta.1 < 0.26.2`
- `hickory-dns <= 0.26.0-alpha.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.