Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| hickory-dns | hickory-dns | unaffected |
|
|||||||||
| hickory-dns | hickory-dns | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 08 Nov 2026 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers able to inject spoofed UDP responses can send QDCOUNT=0 responses to bypass these checks, weakening defenses against DNS spoofing. | |
| Title | Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0 | |
| Weaknesses | CWE-290 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-08T01:38:13.386Z
Reserved: 2026-11-06T00:55:55.660Z
Link: CVE-2026-123578
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-08T02:16:51.207
Modified: 2026-11-08T02:16:51.207
Link: CVE-2026-123578
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-290
Authentication Bypass by Spoofing