Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-123600— Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass

Quick assessment

Affected

hickory-dns hickory-dns

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Hickory DNS 的版本 0.25.0-alpha.3 至 0.25.2，以及版本 0.26.0-alpha.1 至 0.26.2 之前，在中存在一个 DNSSEC 验证缺陷：对于区域顶点（zone-apex）查询，该组件会将带有 NSEC3 签名的 NODATA 响应视为安全响应，即使没有与哈希化查询名称（hashed QNAME）相匹配的 NSEC3 记录。路径上的攻击者或恶意的权威服务器可以重放一个有效签名的非顶点 NSEC3 记录，并配合该区域的已签名 SOA 记录，从而在负缓存的 TTL 有效

CVSS 4.8 · Medium Updated Nov 08, 2026

Possible ATT&CK Techniques 2 AI

T1583 · Acquire Infrastructure T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass

Source: CVE Program / CVE List V5

Vulnerability Description

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

不恰当实现的标准安全检查

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
hickory-dns	hickory-dns	0.25.0-alpha.3 ~ 0.25.2	-
hickory-dns	hickory-dns	0.26.0-alpha.1 ~ 0.26.2	-

II. Public POCs for CVE-2026-123600

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123600

请登录查看更多情报信息。

Other References for CVE-2026-123600 (2)

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3jvh-8vj5-65rq vendor-advisory
https://www.vulncheck.com/advisories/hickory-dns-hickory-proto-0.25.0-alpha.3-through-0.25.2-nsec3-apex-nodata-validation-bypass third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123600

Same Patch Batch · hickory-dns · 2026-11-08 · 39 CVEs total

CVE-2026-123595	8.8 HIGH	Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3
CVE-2026-123605	8.8 HIGH	Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name
CVE-2026-123596	8.8 HIGH	Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC
CVE-2026-123570	7.5 HIGH	Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
CVE-2026-123580	7.5 HIGH	Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3
CVE-2026-123571	7.5 HIGH	Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
CVE-2026-123572	7.5 HIGH	Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser
CVE-2026-123588	7.5 HIGH	Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool
CVE-2026-123575	7.5 HIGH	Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies
CVE-2026-123574	7.5 HIGH	Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser
CVE-2026-123577	7.5 HIGH	Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service
CVE-2026-123604	7.5 HIGH	Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_se
CVE-2026-123576	7.5 HIGH	Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
CVE-2026-123573	7.5 HIGH	hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser
CVE-2026-123607	7.5 HIGH	Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service
CVE-2026-123606	7.5 HIGH	Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification
CVE-2026-123608	7.5 HIGH	Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compressi
CVE-2026-123586	7.5 HIGH	Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals
CVE-2026-123587	6.8 MEDIUM	Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC
CVE-2026-123601	6.5 MEDIUM	Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: hickory-dns

Same vendor: hickory-dns

Same weakness: CWE-358