Description
Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hickory-dns | hickory-dns | < 0.26.0-beta.1, 0.26.0-beta.1 – < 0.26.2 | 0.26.0-beta.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-hickory-net | 0.26.3-1 | — |
| Debian 14 | rust-hickory-proto | No fix yet | — |
| Debian 13 | rust-hickory-proto | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-hickory-net +1 | No fix yet | — |
| Ubuntu 26.04 LTS | rust-hickory-proto | No fix yet | — |
| Ubuntu 24.04 LTS | rust-hickory-proto | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | netavark | No fix yet | — |
References
- GitHub Security Advisory (GHSA-wjgj-fvg9-65w9) vendor-advisory
- VulnCheck Advisory: Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records third-party-advisory