CVE-2026-123596

Summary

A DNSSEC validation flaw in Hickory DNS's NSEC handler incorrectly accepts parent-zone ancestor-delegation NSEC records as proof of nonexistence for names below a zone cut, enabling attackers to forge authenticated NXDOMAIN responses. This allows denial of service for legitimate child-zone names by caching false negative responses for the negative TTL.

Exploitability

Exploitation requires on-path positioning, control of a rogue parent nameserver, or winning a port/TXID race condition; low privilege access (PR:L) is required but not sufficient alone.

Blast radius

Successful exploitation causes authenticated denial of existing child-zone names across affected resolvers, potentially disrupting resolution for multiple downstream clients relying on the compromised cache.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to hickory-proto and hickory-net version 0.26.2 or later, as this is the exact fixed version specified in the CVE description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.