Is CVE-2026-123594 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123594 being exploited in the wild.

How severe is CVE-2026-123594?

Medium severity, with a CVSS score of 4.8, published 8 November 2026.

Which products and versions are affected?

Hickory-Dns Hickory-Net 0.26.0-beta.1 before 0.26.2; Hickory-Dns Hickory-Proto through 0.26.0-alpha.1.

Is there a fix for CVE-2026-123594?

Yes: fixed in hickory-net 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123594 attacked?

It is attacked over the network.

Am I affected by CVE-2026-123594?

Check whether you run Hickory-Dns Hickory-Net or Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123594: Hickory DNS NSEC validation bypass for NXDOMAIN responses

CVE-2026-123594 · Severity: medium · CVSS 4.8 · Published 2026-11-08

Hickory DNS is a Rust implementation of the DNS protocol with DNSSEC support, used for secure domain name resolution. A flaw in NSEC record validation allows attackers on the network path to forge non-existence proofs for domain names, potentially redirecting traffic or enabling DNS spoofing attacks. An attacker can modify the response code of legitimate signed DNS responses without detection, tricking validators into accepting false information about whether a domain exists.

Technologies: Hickory-Dns Hickory-Net, Hickory-Dns Hickory-Proto. Vendors: Hickory-Dns.

Quick answers

Is CVE-2026-123594 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123594 being exploited in the wild.
How severe is CVE-2026-123594?: Medium severity, with a CVSS score of 4.8, published 8 November 2026.
Which products and versions are affected?: Hickory-Dns Hickory-Net 0.26.0-beta.1 before 0.26.2; Hickory-Dns Hickory-Proto through 0.26.0-alpha.1.
Is there a fix for CVE-2026-123594?: Yes: fixed in hickory-net 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123594 attacked?: It is attacked over the network.
Am I affected by CVE-2026-123594?: Check whether you run Hickory-Dns Hickory-Net or Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: hickory-net 0.26.2

Technical details

The NSEC validator incorrectly returns a secure proof (Proof::Secure) for NXDOMAIN responses when the covering NSEC record's Next Domain Name is a strict descendant of the query name, violating RFC 8020 §3.1 and RFC 4035 §3.1.3.2. This condition actually proves the query name exists as an empty non-terminal (ENT). An on-path attacker can flip the unsigned rcode field in the DNS header from NOERROR to NXDOMAIN on genuine signed NODATA responses, and the DNSSEC validation will accept the forgery since RRSIGs do not cover the DNS header.

Affected products

Hickory DNS hickory-proto through 0.26.0-alpha.1
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2

Timeline

2026-09-03: disclosed: GitHub security advisory published
2026-11-08: advisory: CVE-2026-123594 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.