Medium severity4.8NVD Advisory· Published Nov 8, 2026

CVE-2026-123590

Description

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Hickory DNS/Hickory DNSllm-fuzzy
Range: <0.26.2, <=0.26.0-alpha.1

Patches

Vulnerability mechanics

References

github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6nvd
www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-improper-nsec-nsec3-signature-validationnvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000