{"action":"Upgrade hickory-proto to 0.26.0-beta.1 or later.","affected":[{"fixed":"0.26.0-beta.1","introduced":"0.25.0-alpha.3"}],"component":"hickory-proto","cve_ids":["CVE-2026-123607"],"ecosystem":"crates.io","epss":0.00343,"exploited":false,"fixed_versions":["0.26.0-beta.1"],"ghsa_id":"GHSA-3v94-mw7p-v465","id":"tcs_01M5KFBBR8B8Z8CN1HWGYSS470","modified_at":"2026-11-09T09:21:20Z","published_at":"2026-05-01T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0118","https://crates.io/crates/hickory-proto","https://rustsec.org/advisories/RUSTSEC-2026-0118.html","https://github.com/hickory-dns/hickory-dns/pull/3597"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0118","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0118"}],"summary":"NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses"}