Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| hickory-dns | hickory-dns | unaffected |
|
|||||||||
| hickory-dns | hickory-dns | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 08 Nov 2026 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name. | |
| Title | Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals | |
| Weaknesses | CWE-345 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-08T01:38:24.397Z
Reserved: 2026-11-06T00:57:31.045Z
Link: CVE-2026-123594
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-08T02:16:53.710
Modified: 2026-11-08T02:16:53.710
Link: CVE-2026-123594
Redhat
No data.
OpenCVE Enrichment
No data.