CVE-2026-123597

Public on 2026-11-08

Modified on 2026-11-12

Description

Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.

Severity

Low

See what this means

CVSS v3 Base Score

3.7

See breakdown

Affected Packages

Platform	Package	Status
Amazon Linux 2023	aardvark-dns	Not Affected
Amazon Linux 2027 Preview	aardvark-dns	Not Affected
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra	aws-nitro-enclaves-cli	Not Affected
Amazon Linux 2023	aws-nitro-enclaves-cli	Not Affected
Amazon Linux 2027 Preview	aws-nitro-enclaves-cli	Not Affected

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-123597 Mitre: CVE-2026-123597