CVE-2026-123608 is a denial of service vulnerability in hickory-dns versions from 0.3.1 up to but not including 0.26.1. The flaw exists in the BinEncoder component, where a quadratic-time name compression algorithm can be exploited by remote attackers. By sending malicious DNS messages with many records and candidate labels, attackers can trigger repeated linear scans during encoding, leading to CPU exhaustion.
CVE-2026-123607 is a high-severity vulnerability in Hickory DNS affecting versions 0.25.0-alpha.3 through 0.25.2 and 0.26.0-alpha.1 through before 0.26.1. It involves an unbounded loop in the DnssecDnsHandle component during NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. This can lead to memory exhaustion or panic in debug builds when malicious upstream attackers return crafted NoData or NXDomain responses with cross-zone SOA records. The issue is fixed in version 0.26.1.
CVE-2026-123606 is a high-severity vulnerability in hickory-dns recursor versions 0.25.0-alpha.3 through 0.25.2 and hickory-resolver versions 0.26.0-alpha.1 before 0.26.2. The flaw allows remote attackers to cause uncontrolled resource consumption by serving referrals with out-of-bailiwick NS targets lacking glue records. This triggers repeated A and AAAA DNS lookups per target without any per-query work budget, potentially amplifying traffic against remote servers or exhausting the recursor's resources. The issue is fixed in version 0.26.2.
CVE-2026-123605 is a high-severity vulnerability in Hickory DNS affecting versions 0.1 through 0.25.0-alpha.3 and 0.26.0-beta.1 up to but not including 0.26.2. The flaw allows DNSSEC validation bypass due to improper verification of cryptographic signatures. Specifically, the validator accepts RRSIG signatures against the DNSKEY of any name in the Signer's Name field without confirming that this name matches the zone of the RRset. This enables attackers controlling any secure zone to forge valid signatures over arbitrary records in unrelated zones, potentially misleading resolvers, recursors, and clients using DnssecDnsHandle into accepting unauthenticated data as authentic. The issue is fixed in version 0.26.2.
CVE-2026-123604 is a high-severity vulnerability in hickory-dns resolver versions 0.26.0-beta.1 up to but not including 0.26.2. It involves an infinite loop caused by an unbounded retry mechanism in the NameServerPool::try_send function, which re-queues truncated DNS responses without limiting retries. A malicious authoritative DNS server can exploit this by continuously sending truncated responses, causing the resolver to consume resources until the request times out after 5 seconds.
CVE-2026-123603 is an improper access control vulnerability in hickory-dns components prior to version 0.26.2. The affected versions fail to properly canonicalize IPv4-mapped IPv6 addresses when enforcing deny_answers, deny_server, or AccessControlSet rules. This allows attackers to bypass filtering, trigger queries to denied nameservers, or access hickory-server deployments on dual-stack IPv6 sockets from clients that should be denied.
CVE-2026-123602 is a high-severity vulnerability in the Hickory DNS recursor and resolver prior to version 0.26.2. It allows an attacker to perform ghost domain name attacks by exploiting the reuse of stale apex NS RRsets cached from zone NS queries. This flaw enables name servers that have been revoked by the parent zone to continue answering queries indefinitely by repeatedly querying the zone's NS records.
CVE-2026-123601 is a vulnerability in Hickory DNS affecting versions 0.25.0 through 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. The flaw involves inverted relational operators in the wrap-around branch of the find_covering_record() function in nsec3.rs, causing the last NSEC3 record in a zone's hash ring to incorrectly cover every hash except its owner. This allows attackers who can inject DNS responses to replay that NSEC3 record and its RRSIG, forging DNSSEC-validated negative responses that deny legitimate DNS names. The vulnerability has a high severity with a CVSS 4.0 score of 8.3. A fix is available in version 0.26.2.
CVE-2026-123600 is a vulnerability in hickory-dns affecting versions 0.25.0-alpha.3 through 0.25.2 and 0.26.0-alpha.1 before 0.26.2. It involves a DNSSEC validation flaw where the component DnssecDnsHandle incorrectly accepts certain NSEC3-signed NODATA responses for zone-apex queries as secure without proper matching NSEC3 records. This allows on-path attackers or malicious authoritative servers to replay signed non-apex NSEC3 records with the zone's signed SOA, resulting in an authenticated denial of any apex resource record type for the negative-cache TTL period. The issue has a medium severity with a CVSS 4.0 score of 6.3 and is fixed in version 0.26.2.
CVE-2026-123599 is a vulnerability in hickory-dns where DNSSEC validation can be bypassed due to improper handling of DNS class in verify_rrsets(). This allows attackers supplying DNS responses to forge certain DNS records, potentially authenticating any DNSKEY and forging child zone responses. The issue affects hickory-proto versions before 0.26.0-beta.1 and hickory-net versions before 0.26.2. A fix is available in versions 0.26.0-beta.1 and 0.26.2.
CVE-2026-123598 is a vulnerability in Hickory DNS validating recursor components where DNSSEC-bogus answers are cached using the attacker-supplied TTL, allowing a remote attacker to keep invalid DNS responses cached for up to 24 hours. This affects versions from 0.25.0 through 0.26.0-alpha.1, 0.26.0-alpha.1 before 0.26.2, and 0.26.0-beta.1 before 0.26.2. The issue is fixed in version 0.26.2.
CVE-2026-123597 is a vulnerability in hickory-dns affecting versions 0.25.0-alpha.1 through 0.26.0-alpha.1 and 0.26.0-beta.1 up to but not including 0.26.2. It involves a logic bug in the DnssecDnsHandle component where transient DS lookup errors are cached as permanent DNSSEC validation failures. An attacker can trigger SERVFAIL, REFUSED, or timeout responses to cause persistent denial of DNS resolution for all names under a targeted child zone until the cache entry expires.
CVE-2026-123596 is a high-severity vulnerability in hickory-dns affecting versions up to 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. It involves a DNSSEC validation flaw in the validating recursor's NSEC handler that incorrectly accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. This flaw allows an attacker capable of on-path interception, rogue parent nameserver control, or winning a port and TXID race to forge an NXDOMAIN response that causes authenticated denial of existing child-zone names cached for the negative TTL. The issue is fixed in version 0.26.2.
CVE-2026-123595 is a high-severity vulnerability in Hickory DNS affecting versions 0.25 through 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. It involves a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which improperly verifies nonexistence proofs by matching hashes without checking the type bitmap. This flaw allows an attacker to cause NXDOMAIN or NODATA responses with AD=1 to be cached, effectively denying resolution of existing domain names at and below the zone cut. The issue is fixed in version 0.26.2.
CVE-2026-123594 is a vulnerability in Hickory DNS affecting versions up to 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. It involves an NSEC validation flaw that incorrectly validates NXDOMAIN responses, allowing on-path attackers to forge nonexistence proofs for DNS names. This can cause DNS validators to accept forged NXDOMAIN responses instead of genuine NODATA responses.
CVE-2026-123593 affects hickory-dns components where DNSKEY public keys are compared against DNSSEC trust anchors without verifying the DNSKEY record name. This flaw allows an attacker who can spoof or control DNS responses to substitute a secure zone's DNSKEY RRset with the root zone's keys, potentially bypassing RRSIG verification and leveraging large TTL values to maintain malicious cache entries. Versions before 0.26.2 of hickory-net and certain alpha versions of hickory-proto are impacted.
CVE-2026-123592 is a vulnerability in the hickory-net crate of Hickory DNS versions 0.26.0-beta.1 up to but not including 0.26.2. It allows DNSSEC validation bypass due to improper comparison logic that ignores label lengths and only compares a hash of the name, enabling attackers controlling certain unsigned delegations to cause forged DNS answers to bypass signature verification.
CVE-2026-123591 is a vulnerability in Hickory DNS affecting versions 0.26.0-beta.1 through before 0.26.2 and hickory-proto through 0.26.0-alpha.1. The software fails to verify that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists, as required by RFC 6840 §4.4. This flaw allows attackers to reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records. A fix is available in version 0.26.2. The vulnerability has a high severity with a CVSS 4.0 score of 8.2.
CVE-2026-123590 is a vulnerability in Hickory DNS affecting versions 0.26.0-beta.1 through before 0.26.2 and hickory-proto up to 0.26.0-alpha.1. The flaw allows attackers who can supply DNS responses to forge DNSSEC nonexistence proofs by mixing validly signed records with bogus NSEC or NSEC3 records of different types sharing the same owner name. This improper verification of cryptographic signatures can lead to acceptance of forged DNS data.
CVE-2026-123589 affects hickory-dns versions before 0.26.2. The DNS-over-QUIC server component does not enforce any timeout when reading request messages from QUIC streams. This allows a remote unauthenticated attacker to open connections and hold request streams open indefinitely, leading to resource exhaustion and denial of service.