Hickory DNS CVE-2026-123579

Exploitation requires all of: (1) the victim running affected code - hickory-net 0.26.0-beta.1 through 0.26.1, or hickory-proto at or below 0.26.0-alpha.1 - with DNSSEC validation enabled; (2) the queried zone containing records with wildcard names; (3) a query whose correct answer is NODATA (the name/type should not exist as positive data); and (4) the attacker being able to deliver a crafted response, combining an NSEC3 record matching the query name with the signed wildcard record and its signature. Limiting factors: this only works against zones that actually use wildcards, only for queries that should return NODATA, and the attacker must be able to inject or forge the DNS response path (on-path or cache-poisoning position) - reflected by AC:H and AT:P. No authentication is required (PR:N). hickory-proto users have no fixed release available.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 (medium): it is network-reachable and needs no privileges or user interaction, but AC:H plus AT:P signal real preconditions - the attacker must be positioned to inject or forge DNS responses AND the target zone must contain wildcard records for a query that should return NODATA. Impact is narrow: only VI:L (integrity of resolved data) with VC:N and VA:N, so this is a DNSSEC validation bypass, not confidentiality loss. The vuln.today decision label is 'this_month' (moderate urgency), consistent with the absence of KEV listing and no public exploit. No EPSS score was provided; KEV status is NO and no PoC/exploit reference is present, so exploitation is unproven. Note a signal conflict: the 'Information Disclosure' tag does not match the CVSS impact profile (VC:N, VI:L) or the description, which describes acceptance of a bogus positive response - an integrity/validation-bypass problem, not information disclosure. Overall: a legitimate DNSSEC-integrity flaw warranting patching on a normal cycle rather than crisis response.

A resolver or client built on affected hickory-net/hickory-proto performs DNSSEC validation against a zone that contains wildcard records. An attacker able to supply the DNS response crafts a bogus positive answer by combining an NSEC3 record matching the query name, a legitimately signed wildcard record, and its signature; validation accepts it even though the query should have returned NODATA, so the victim receives a forged positive record. No public exploit code was identified at time of analysis.