# CVE-2026-123595: Hickory DNS DNSSEC validation bypass in NSEC3 handler

Source: https://junglewise.ai/threats/cve-2026-123595-hickory-dns-hickory-proto-0-25-through-0-26-0-alpha-1-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123595 · Severity: high · CVSS 8.8 · Published 2026-11-08

Hickory DNS is a DNS resolver library used to look up internet domain names. A flaw in its DNSSEC validation allows an attacker to inject a specially-crafted DNS response that causes the resolver to permanently cache false "domain does not exist" answers with a trusted signature, blocking legitimate users from resolving existing domains. An attacker only needs to deliver one malicious response—no compromised keys required.

Technologies: [Hickory-Dns Hickory-Net](https://junglewise.ai/threats/technologies/hickory-dns-hickory-net), [Hickory-Dns Hickory-Proto](https://junglewise.ai/threats/technologies/hickory-dns-hickory-proto). Vendors: [Hickory-Dns](https://junglewise.ai/threats/vendors/hickory-dns).

## Quick answers

**Is CVE-2026-123595 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123595 being exploited in the wild.

**How severe is CVE-2026-123595?** High severity, with a CVSS score of 8.8, published 8 November 2026.

**Which products and versions are affected?** Hickory-Dns Hickory-Net 0.26.0-beta.1 before 0.26.2; Hickory-Dns Hickory-Proto 0.25 through 0.26.0-alpha.1.

**Is there a fix for CVE-2026-123595?** Yes: fixed in hickory-proto: no patched version released; hickory-net 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123595 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123595?** Check whether you run Hickory-Dns Hickory-Net or Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in hickory-proto: no patched version released; hickory-net 0.26.2

## Technical details

The validating recursor's NSEC3 handler fails to implement RFC 6840 §4.1 and RFC 5155 §8.3 ancestor-delegation exclusion checks. When matching the closest encloser in NXDOMAIN and NODATA proofs, it compares NSEC3 hashes alone without inspecting the type bitmap, allowing parent-side NSEC3 records at zone cuts to be accepted as authentic proof of nonexistence for child-zone names. An attacker can deliver one response using genuinely signed parent NSEC3 records to cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution for up to the negative TTL.

## Affected products

- Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1
- Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2

## Timeline

- 2026-09-03: disclosed: GitHub Security Advisory GHSA-624w-vvww-xvpw published
- 2026-11-08: advisory: CVE-2026-123595 assigned

## References

- [https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw)
- [https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3](https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3)

## Related threats

- [Hickory DNS hickory-proto denial of service in BinEncoder](https://junglewise.ai/threats/cve-2026-123608-hickory-dns-hickory-proto-from-0-3-1-before-0-26-1-contains-a)
- [Hickory DNS NSEC3 closest-encloser proof unbounded loop](https://junglewise.ai/threats/cve-2026-123607-hickory-dns-hickory-proto-0-25-0-alpha-3-through-0-25-2-and)
- [Hickory DNS DNSSEC validation bypass via RRSIG Signer's Name](https://junglewise.ai/threats/cve-2026-123605-hickory-dns-hickory-proto-0-1-through-0-25-0-alpha-3-and-hickory)
- [Hickory DNS IPv4-mapped IPv6 canonicalization bypass](https://junglewise.ai/threats/cve-2026-123603-hickory-proto-and-hickory-resolver-0-26-0-before-0-26-2-hickory)
- [Hickory DNS NSEC3 comparison operator inversion](https://junglewise.ai/threats/cve-2026-123601-hickory-dns-hickory-proto-0-25-0-through-0-26-0-alpha-1-and)