Hickory DNS CVE-2026-123580

Exploitation requires the target to run an affected build (hickory-net 0.26.0-beta.1 through 0.26.1, or hickory-proto through 0.26.0-alpha.1) as a DNSSEC-validating resolver using NSEC3 nonexistence proofs. The attacker must be positioned to supply DNS responses to the victim (on-path interception or a malicious/authoritative server the resolver queries) and must possess an NSEC3 record from a different zone whose hashed last label collides with the queried name. Limiting factors: DNSSEC validation must be enabled and reach NSEC3 processing; the attacker needs a response-injection position despite the network vector; and the cross-zone matching-hash requirement is a real practical constraint not reflected in the AC:L rating. Impact is confined to integrity (forged denial-of-existence); no confidentiality or availability impact is indicated.

Signals are moderately consistent and point to a real but bounded integrity threat. The vendor/VulnCheck CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and the impact is integrity-only (VC:N/VI:H/VA:N): the flaw lets an attacker forge DNSSEC denial-of-existence proofs, defeating the authenticity guarantee DNSSEC exists to provide (CWE-290/CWE-345). There is no CISA KEV listing, no EPSS score, and no PoC or exploit reference in the provided sources, so this is 'no public exploit identified at time of analysis'; the vuln.today decision label is 'this_week', not act_now/emergency. The practical priority is elevated for deployments that use the affected hickory versions as DNSSEC-validating resolvers, because forged nonexistence proofs enable downgrade/suppression attacks (e.g., denying DANE/TLSA, CAA, or MX records). Two factors temper raw-score urgency and should be verified: (1) the AC:L rating understates a real precondition - the attacker must obtain or craft an NSEC3 record from another zone whose hashed label matches the target name, which is non-trivial and not described as attacker-trivial in the sources; and (2) AV:N/PR:N implies remote unauthenticated reach, but delivering forged records in practice requires an on-path position or a malicious authoritative server the victim queries. hickory-proto remains unpatched, which raises residual risk for consumers of that crate.

An attacker able to answer a victim resolver's queries - on-path, or by operating a malicious authoritative server the resolver consults - returns NSEC3 records taken from a different zone whose hashed label matches the queried name. Because hickory compares only the hash in the last label and never confirms the record belongs to the correct zone, the DNSSEC validator accepts a forged proof that the name does not exist, enabling denial-of-existence spoofing and downgrade attacks. No public exploit is identified in the provided sources.