Description
Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hickory-dns | hickory-dns | 0.1 – ≤ 0.25.0-alpha.3, 0.26.0-beta.1 – < 0.26.2 | 0.26.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-hickory-net | 0.26.3-1 | — |
| Debian 14 | rust-hickory-proto | No fix yet | — |
| Debian 13 | rust-hickory-proto | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-hickory-net +1 | No fix yet | — |
| Ubuntu 26.04 LTS | rust-hickory-proto | No fix yet | — |
| Ubuntu 24.04 LTS | rust-hickory-proto | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | netavark | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | hickory-net | >= 0.0.0-0, < 0.26.2 | 0.26.2 | RUSTSEC-2026-0507 |
References
- GitHub Security Advisory (GHSA-2vgh-3wfw-qj7c) vendor-advisory
- VulnCheck Advisory: Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name third-party-advisory