{
  "cveId": "CVE-2026-123580",
  "url": "https://patchblox.com/security/cve/CVE-2026-123580",
  "summary": "CVE-2026-123580 is fixed in rust-hickory-net on 1 platform by DEBIAN-CVE-2026-123580 (version 0.26.3-1), released November 9, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "rust-hickory-net: Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient che...",
  "description": "Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.",
  "published": "2026-11-08T02:16:51Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "epss": 0.00255,
  "epssPercentile": 0.17224,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rust-hickory-net",
      "release": "Debian 14",
      "fixedVersion": "0.26.3-1",
      "fix": "DEBIAN-CVE-2026-123580",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-123580",
      "released": "2026-11-09T02:18:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T01:43:54Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}