Hickory DNS CVE-2026-123582

Exploitation requires an attacker able to supply forged DNS responses (an on-path position or a successful off-path spoofing/forgery), and is limited to Hickory DNS (hickory-server) 0.25.0 through 0.26.1 running specifically in validating recursive resolver or validating forwarder mode. The flaw only manifests in negative responses - NXDOMAIN or NODATA - where the SOA record's DNSSEC validation status is not checked. Real-world impact is further constrained to situations where downstream clients both rely on this resolver/forwarder to perform DNSSEC validation AND use the SOA record contents for some purpose; clients that do not consume the SOA, or deployments not performing validation, are unaffected. There is no confidentiality or availability impact and no privilege or user-interaction requirement.

This is a moderate-severity DNSSEC validation bypass (CVSS 4.0 base 6.3) affecting Hickory DNS when operating as a validating recursive resolver or validating forwarder. The CVSS vector signals network attack vector (AV:N) with no privileges or user interaction, but a present attack requirement (AT:P) - the attacker must be able to supply forged DNS responses, meaning off-path spoofing or an on-path position, which is a real barrier against a modern resolver. Impact is limited to integrity (VI:L) with no confidentiality or availability effect, consistent with the ability to inject only a forged SOA record into NXDOMAIN/NODATA negative answers while the AD bit is incorrectly set. No EPSS score is provided and the vulnerability is not on CISA KEV, so there is no confirmed active exploitation; the vuln.today decision label is 'this_month' rather than act_now/emergency, indicating prioritized patching but not emergency response. No exploit code is referenced - only vendor/coordinator advisories (GHSA and VulnCheck). The practical risk is further gated because harm only materializes when downstream clients BOTH rely on this resolver for DNSSEC validation AND act on the SOA record contents, making this a real but conditional priority rather than a broadly weaponizable flaw.

An attacker positioned to inject or spoof DNS responses (on-path, or an off-path attacker who can forge/race responses) returns a crafted negative answer containing a forged SOA record for a name under a DNSSEC-signed zone. Because Hickory DNS does not verify that the SOA passed DNSSEC validation when building NXDOMAIN/NODATA responses, it forwards the forged SOA to the client with the AD bit set, and a client that trusts the resolver's validation and consumes the SOA contents is misled. No public exploit identified at time of analysis.