Is CVE-2026-123595 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123595 being exploited in the wild.

How severe is CVE-2026-123595?

High severity, with a CVSS score of 8.8, published 8 November 2026.

Which products and versions are affected?

Hickory-Dns Hickory-Net 0.26.0-beta.1 before 0.26.2; Hickory-Dns Hickory-Proto 0.25 through 0.26.0-alpha.1.

Is there a fix for CVE-2026-123595?

Yes: fixed in hickory-proto: no patched version released; hickory-net 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123595 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123595?

Check whether you run Hickory-Dns Hickory-Net or Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123595: Hickory DNS DNSSEC validation bypass in NSEC3 handler

CVE-2026-123595 · Severity: high · CVSS 8.8 · Published 2026-11-08

Hickory DNS is a DNS resolver library used to look up internet domain names. A flaw in its DNSSEC validation allows an attacker to inject a specially-crafted DNS response that causes the resolver to permanently cache false "domain does not exist" answers with a trusted signature, blocking legitimate users from resolving existing domains. An attacker only needs to deliver one malicious response—no compromised keys required.

Technologies: Hickory-Dns Hickory-Net, Hickory-Dns Hickory-Proto. Vendors: Hickory-Dns.

Quick answers

Is CVE-2026-123595 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123595 being exploited in the wild.
How severe is CVE-2026-123595?: High severity, with a CVSS score of 8.8, published 8 November 2026.
Which products and versions are affected?: Hickory-Dns Hickory-Net 0.26.0-beta.1 before 0.26.2; Hickory-Dns Hickory-Proto 0.25 through 0.26.0-alpha.1.
Is there a fix for CVE-2026-123595?: Yes: fixed in hickory-proto: no patched version released; hickory-net 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123595 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123595?: Check whether you run Hickory-Dns Hickory-Net or Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: hickory-proto: no patched version released; hickory-net 0.26.2

Technical details

The validating recursor's NSEC3 handler fails to implement RFC 6840 §4.1 and RFC 5155 §8.3 ancestor-delegation exclusion checks. When matching the closest encloser in NXDOMAIN and NODATA proofs, it compares NSEC3 hashes alone without inspecting the type bitmap, allowing parent-side NSEC3 records at zone cuts to be accepted as authentic proof of nonexistence for child-zone names. An attacker can deliver one response using genuinely signed parent NSEC3 records to cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution for up to the negative TTL.

Affected products

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2

Timeline

2026-09-03: disclosed: GitHub Security Advisory GHSA-624w-vvww-xvpw published
2026-11-08: advisory: CVE-2026-123595 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.