DEBIAN-CVE-2026-123605

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-123605
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123605.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-123605
Upstream
Published
2026-11-08T02:16:55Z
Modified
2026-11-08T16:00:08Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.

References

Affected packages

Debian:14 / rust-hickory-net

Package

Name
rust-hickory-net
Purl
pkg:deb/debian/rust-hickory-net?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.26.3-1

Affected versions

0.*
0.26.1-1
0.26.1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123605.json"

Debian:13 / rust-hickory-proto

Package

Name
rust-hickory-proto
Purl
pkg:deb/debian/rust-hickory-proto?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.24.4-2
0.24.4-3
0.24.4-4
0.24.4-4.1
0.24.4-5
0.24.4-6
0.25.2-1
0.25.2-2
0.25.2-3
0.26.1-1
0.26.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123605.json"

Debian:14 / rust-hickory-proto

Package

Name
rust-hickory-proto
Purl
pkg:deb/debian/rust-hickory-proto?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.24.4-2
0.24.4-3
0.24.4-4
0.24.4-4.1
0.24.4-5
0.24.4-6
0.25.2-1
0.25.2-2
0.25.2-3
0.26.1-1
0.26.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123605.json"