# CVE-2026-123601: Hickory DNS NSEC3 comparison operator inversion

Source: https://junglewise.ai/threats/cve-2026-123601-hickory-dns-hickory-proto-0-25-0-through-0-26-0-alpha-1-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123601 · Severity: medium · CVSS 6.5 · Published 2026-11-08

Hickory DNS is a Rust-based DNS resolver library that validates domain name authenticity using DNSSEC. A logic error in its NSEC3 record validation allows attackers who can inject DNS responses to forge proofs that legitimate domain names don't exist, causing DNS lookups to fail for valid domains. This affects any application using Hickory for DNSSEC-validated DNS resolution.

Technologies: [Hickory-Dns Hickory-Net](https://junglewise.ai/threats/technologies/hickory-dns-hickory-net), [Hickory-Dns Hickory-Proto](https://junglewise.ai/threats/technologies/hickory-dns-hickory-proto). Vendors: [Hickory-Dns](https://junglewise.ai/threats/vendors/hickory-dns).

## Quick answers

**Is CVE-2026-123601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123601 being exploited in the wild.

**How severe is CVE-2026-123601?** Medium severity, with a CVSS score of 6.5, published 8 November 2026.

**Which products and versions are affected?** Hickory-Dns Hickory-Net 0.26.0-beta.1 before 0.26.2; Hickory-Dns Hickory-Proto 0.25.0 through 0.26.0-alpha.1.

**Is there a fix for CVE-2026-123601?** Yes: fixed in hickory-proto (no fix listed); hickory-net 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123601 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123601?** Check whether you run Hickory-Dns Hickory-Net or Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in hickory-proto (no fix listed); hickory-net 0.26.2

## Technical details

The find_covering_record() function in nsec3.rs inverts the relational operators in the wrap-around branch, causing the last NSEC3 record in the zone's hash ring to be treated as covering every hash except its owner rather than correctly covering the wrap-around range. An attacker with ability to inject DNS responses can obtain this NSEC3 record and its RRSIG signature, then replay them to forge DNSSEC-validated negative responses (proof of nonexistence) for legitimate domain names.

## Affected products

- Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1
- Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2

## Timeline

- 2026-09-03: disclosed: GitHub Security Advisory GHSA-588m-chg6-8jqj published
- 2026-11-08: advisory: CVE-2026-123601 published

## References

- [https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj)
- [https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-nsec3-proof-of-nonexistence-forgery](https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-nsec3-proof-of-nonexistence-forgery)

## Related threats

- [Hickory DNS hickory-proto denial of service in BinEncoder](https://junglewise.ai/threats/cve-2026-123608-hickory-dns-hickory-proto-from-0-3-1-before-0-26-1-contains-a)
- [Hickory DNS NSEC3 closest-encloser proof unbounded loop](https://junglewise.ai/threats/cve-2026-123607-hickory-dns-hickory-proto-0-25-0-alpha-3-through-0-25-2-and)
- [Hickory DNS DNSSEC validation bypass via RRSIG Signer's Name](https://junglewise.ai/threats/cve-2026-123605-hickory-dns-hickory-proto-0-1-through-0-25-0-alpha-3-and-hickory)
- [Hickory DNS IPv4-mapped IPv6 canonicalization bypass](https://junglewise.ai/threats/cve-2026-123603-hickory-proto-and-hickory-resolver-0-26-0-before-0-26-2-hickory)
- [Hickory DNS DNSSEC validation bypass in NSEC3 NODATA](https://junglewise.ai/threats/cve-2026-123600-hickory-dns-hickory-proto-0-25-0-alpha-3-through-0-25-2-and)