CVE-2026-123598 is a vulnerability in Hickory DNS validating recursor components where DNSSEC-bogus answers are cached using the attacker-supplied TTL, allowing a remote attacker to keep invalid DNS responses cached for up to 24 hours. This affects versions from 0.25.0 through 0.26.0-alpha.1, 0.26.0-alpha.1 before 0.26.2, and 0.26.0-beta.1 before 0.26.2. The issue is fixed in version 0.26.2.
CVE-2026-123597 is a vulnerability in hickory-dns affecting versions 0.25.0-alpha.1 through 0.26.0-alpha.1 and 0.26.0-beta.1 up to but not including 0.26.2. It involves a logic bug in the DnssecDnsHandle component where transient DS lookup errors are cached as permanent DNSSEC validation failures. An attacker can trigger SERVFAIL, REFUSED, or timeout responses to cause persistent denial of DNS resolution for all names under a targeted child zone until the cache entry expires.
CVE-2026-123596 is a high-severity vulnerability in hickory-dns affecting versions up to 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. It involves a DNSSEC validation flaw in the validating recursor's NSEC handler that incorrectly accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. This flaw allows an attacker capable of on-path interception, rogue parent nameserver control, or winning a port and TXID race to forge an NXDOMAIN response that causes authenticated denial of existing child-zone names cached for the negative TTL. The issue is fixed in version 0.26.2.
CVE-2026-123595 is a high-severity vulnerability in Hickory DNS affecting versions 0.25 through 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. It involves a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which improperly verifies nonexistence proofs by matching hashes without checking the type bitmap. This flaw allows an attacker to cause NXDOMAIN or NODATA responses with AD=1 to be cached, effectively denying resolution of existing domain names at and below the zone cut. The issue is fixed in version 0.26.2.
CVE-2026-123594 is a vulnerability in Hickory DNS affecting versions up to 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. It involves an NSEC validation flaw that incorrectly validates NXDOMAIN responses, allowing on-path attackers to forge nonexistence proofs for DNS names. This can cause DNS validators to accept forged NXDOMAIN responses instead of genuine NODATA responses.
CVE-2026-123593 affects hickory-dns components where DNSKEY public keys are compared against DNSSEC trust anchors without verifying the DNSKEY record name. This flaw allows an attacker who can spoof or control DNS responses to substitute a secure zone's DNSKEY RRset with the root zone's keys, potentially bypassing RRSIG verification and leveraging large TTL values to maintain malicious cache entries. Versions before 0.26.2 of hickory-net and certain alpha versions of hickory-proto are impacted.
CVE-2026-123592 is a vulnerability in the hickory-net crate of Hickory DNS versions 0.26.0-beta.1 up to but not including 0.26.2. It allows DNSSEC validation bypass due to improper comparison logic that ignores label lengths and only compares a hash of the name, enabling attackers controlling certain unsigned delegations to cause forged DNS answers to bypass signature verification.
CVE-2026-123591 is a vulnerability in Hickory DNS affecting versions 0.26.0-beta.1 through before 0.26.2 and hickory-proto through 0.26.0-alpha.1. The software fails to verify that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists, as required by RFC 6840 §4.4. This flaw allows attackers to reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records. A fix is available in version 0.26.2. The vulnerability has a high severity with a CVSS 4.0 score of 8.2.
CVE-2026-123590 is a vulnerability in Hickory DNS affecting versions 0.26.0-beta.1 through before 0.26.2 and hickory-proto up to 0.26.0-alpha.1. The flaw allows attackers who can supply DNS responses to forge DNSSEC nonexistence proofs by mixing validly signed records with bogus NSEC or NSEC3 records of different types sharing the same owner name. This improper verification of cryptographic signatures can lead to acceptance of forged DNS data.
CVE-2026-123589 affects hickory-dns versions before 0.26.2. The DNS-over-QUIC server component does not enforce any timeout when reading request messages from QUIC streams. This allows a remote unauthenticated attacker to open connections and hold request streams open indefinitely, leading to resource exhaustion and denial of service.
CVE-2026-123588 is a high-severity vulnerability in Hickory DNS's recursive resolver affecting all versions of the hickory-recursor crate and hickory-resolver versions before 0.26.2. The resolver caches an empty connection pool when it encounters a referral with no glue records and all IP address queries for the name servers fail. An attacker capable of spoofing DNS responses can exploit this to cause all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.
CVE-2026-123587 is a high-severity vulnerability in the Hickory DNS hickory-net crate versions 0.26.0 up to but not including 0.26.2. It involves an authentication bypass via spoofing in DNSSEC validation, where crafted responses can cause the software to incorrectly accept invalid SOA records. This allows attackers who can supply DNS responses to forge the nonexistence of any resource record set (RRset).
CVE-2026-123586 is a high-severity vulnerability in hickory-dns versions 0.25.0-alpha.3 through 0.25.2. It involves a query amplification flaw in the recursive resolver caused by mishandling cyclic sibling name server referrals without glue records. This can cause the resolver to loop, generating many upstream queries amplified by zero-TTL NS records. The issue is fixed in version 0.26.2.
CVE-2026-123585 is a vulnerability in the hickory-resolver component of Hickory DNS versions 0.25.0 up to but not including 0.26.2. The resolver follows irrelevant CNAME records when resolving recursive queries, leading to unnecessary DNS queries. This behavior can be exploited by attackers controlling DNS responses to cause excessive resolver queries and increased query amplification.
CVE-2026-123584 is a vulnerability in the hickory-net crate of Hickory DNS versions 0.26.0 through before 0.26.2. It causes the DNS client to stop listening and return an error when receiving a malformed UDP datagram that cannot be parsed as a DNS message. This allows remote attackers who can guess the source port but not the transaction ID to send spoofed malformed responses that abort client queries, resulting in denial of service.
CVE-2026-123583 is a vulnerability in Hickory DNS recursive resolver versions 0.25.0 through 0.25.2 and hickory-resolver versions 0.26.0 before 0.26.2. The flaw involves the failure to apply out-of-bailiwick filtering to negative DNS responses, allowing attackers to inject crafted out-of-bailiwick records. This can facilitate cache poisoning and make exploitation of other DNSSEC verification flaws easier. The issue is fixed in version 0.26.2.
CVE-2026-123582 is a vulnerability in Hickory DNS versions 0.25.0 up to but not including 0.26.2. The validating recursive resolver and forwarder do not verify that the SOA record has passed DNSSEC validation when creating NXDOMAIN or NODATA responses. This flaw allows an attacker who can forge DNS responses to supply a forged SOA record with the AD bit set, potentially misleading clients that trust the server's DNSSEC validation.
CVE-2026-123581 is a vulnerability in Hickory DNS affecting versions up to 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. It involves a DNSSEC validation flaw where the software incorrectly accepts DNS responses as valid if any signed RRset is present, without verifying that the RRset matches the query. This can allow attackers to supply signed but unrelated RRsets, causing responses that lack matching records to be validated as positive answers instead of no-data responses.
CVE-2026-123580 is an authentication bypass vulnerability in Hickory DNS affecting versions 0.26.0-beta.1 through before 0.26.2 and hickory-proto through 0.26.0-alpha.1. The flaw arises from insufficient validation of NSEC3 record names during DNSSEC verification, where only the hashed label is checked without confirming the record's zone membership. This allows attackers to forge DNSSEC nonexistence proofs by supplying NSEC3 records from other zones with matching hash labels.
CVE-2026-123579 is a vulnerability in Hickory DNS affecting versions 0.26.0-beta.1 through before 0.26.2 and hickory-proto through 0.26.0-alpha.1. The DNSSEC validation does not properly distinguish between NODATA responses and wildcard-expanded positive responses. This flaw allows an attacker to craft a bogus positive DNS response by combining an NSEC3 record with a signed wildcard record, which the validation process incorrectly accepts.