CVE-2026-123579

CVSS 6.3 (medium) · published 2026-11-08

DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.

Weakness: CWE-358

Source: NVD CVE-2026-123579

References

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vrv5-968r-5ggm
• https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-wildcard-expansion

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.