AIKIDO-2026-116249
hickory-net is vulnerable to Improper Verification of Cryptographic Signature
75
High Risk
This Affects:
hickory-netTL;DR
DNSSEC verification of NSEC3 records only compares the hash in the record's first label against the tested name's hash and does not check the rest of the record name to confirm it belongs to the correct zone. A validly signed NSEC3 record from another zone can therefore be used in a nonexistence proof. This allows forgery of proofs of nonexistence. The fix verifies the full NSEC3 owner name against the zone.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have DNSSEC validation enabled
Background info
hickory-net is vulnerable to Improper Verification of Cryptographic Signature in versions 0.26.0 - 0.26.1.
How to fix this
Upgrade the hickory-net library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.