---
id: CVE-2026-123599
title: >-
  Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class
  Records
summary: >-
  Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2
  contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class
  when partitioning RRsets, so non-IN records skip signature verification yet
  are mar…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-345
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns < 0.26.0-beta.1
  - hickory-dns >= 0.26.0-beta.1 < 0.26.2
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:27.812Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123599'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wjgj-fvg9-65w9
    label: GitHub Security Advisory (GHSA-wjgj-fvg9-65w9)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-before-0.26.0-beta.1-dnssec-validation-bypass-via-non-in-class-records
    label: >-
      VulnCheck Advisory: Hickory DNS before 0.26.0-beta.1 DNSSEC Validation
      Bypass via Non-IN Class Records
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.642Z'
---

## Overview

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

## Affected

- `hickory-dns < 0.26.0-beta.1`
- `hickory-dns >= 0.26.0-beta.1 < 0.26.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.