CVE-2026-123595

Summary

A DNSSEC validation flaw in Hickory DNS's NSEC3 handler incorrectly accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence by matching only the closest encloser hash without verifying the type bitmap. This allows an attacker to cause legitimate names to be cached as NXDOMAIN or NODATA with AD=1, breaking resolution for valid domains at and below the zone cut.

Exploitability

Exploitation requires the attacker to control or intercept DNS responses and deliver a specially crafted response containing validly signed parent-side NSEC3 records, which is feasible in certain network positions (e.g., MITM or compromised resolver infrastructure) but not trivial for remote unauthenticated attackers.

Blast radius

Successful exploitation can cause widespread denial of service for affected zones, as legitimate queries for existing names will be incorrectly resolved as non-existent, potentially impacting all downstream clients using the vulnerable recursor.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to hickory-proto/hickory-net version 0.26.2 or later, which includes the fix for the NSEC3 validation flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.