Hickory DNS CVE-2026-123578

Exploitation requires an attacker able to inject spoofed UDP DNS responses to a Hickory DNS UDP client connection and to deliver a response with an empty question section (QDCOUNT=0), which causes the question-section match check to be skipped and, if case_randomization is enabled, the query-name capitalization (0x20) check to be skipped as well. This is a defense-in-depth weakening, not standalone spoofing: the attacker still must satisfy the remaining matching criteria (e.g., transaction ID and source port) and win the race against the legitimate response - reflected in CVSS AC:H/AT:P. It applies to UDP client connections in hickory-net 0.26.0-0.26.1 and hickory-proto 0.25.0-0.25.2; TCP and other configurations are not implicated by the available sources, and the trigger is otherwise as described in the GHSA.

This is a genuine but moderate-priority issue, not a drop-everything emergency, and the signals are internally consistent. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 (Medium): network-reachable and unauthenticated, but with high attack complexity and an explicit attack requirement (AT:P), reflecting that an attacker must be able to inject spoofed UDP responses and win the race against the legitimate resolver reply. The only impact is VI:L - the flaw removes one layer of defense-in-depth against DNS cache/response spoofing rather than directly granting integrity compromise on its own; confidentiality and availability are untouched (VC:N/VA:N). No KEV listing is present and no EPSS score was supplied, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', not act_now/emergency, which aligns with a patch-on-normal-cycle posture. The references are vendor/coordinator advisories (GHSA and VulnCheck), not verified working exploit code. A notable caveat: hickory-net is fixed in 0.26.2, but hickory-proto (0.25.0-0.25.2) is listed as not yet patched, so consumers of the proto crate have no fixed release to move to yet - that unpatched state, rather than raw CVSS, is the main reason to track this actively.

An off-path or on-path attacker who can inject spoofed UDP DNS responses sends a forged reply with an empty question section (QDCOUNT=0) while the Hickory UDP client is awaiting an answer. Because the empty question section skips both the question-section match check and, when case_randomization is enabled, the 0x20 case-matching check, the forged response is more likely to be accepted, helping the attacker slip a spoofed answer past validation while racing the legitimate reply. No verified working public exploit code was identified; only vendor/coordinator advisories (GHSA, VulnCheck) are available.