Hickory DNS CVE-2026-123583

The attacker must be able to supply crafted negative DNS responses (NXDOMAIN/NODATA) to the Hickory recursive resolver - e.g. operating or compromising an authoritative server in the resolution path, or spoofing responses as an off-path attacker - which is the specific precondition reflected by AT:P. The affected feature is the recursive resolver's handling of negative responses in hickory-recursor 0.25.0-0.25.2 and hickory-resolver 0.26.0-0.26.1, where out-of-bailiwick records in such responses are not filtered. Limiting factors: no authentication is required (PR:N) and no user interaction (UI:N), but impact is only low integrity (VI:L) - the flaw facilitates cache poisoning and eases exploitation of other DNSSEC verification bugs rather than granting direct compromise on its own, so realistic risk depends on an attacker also having or chaining those conditions.

Signals are consistent and point to a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 (Medium) with only low integrity impact (VI:L) and no confidentiality or availability impact, which matches the nature of the flaw: it does not itself compromise a system but weakens a defense-in-depth control (out-of-bailiwick filtering) on negative DNS responses, facilitating cache poisoning and making exploitation of other DNSSEC verification flaws easier. The AT:P (attack requirement present) metric reflects that the attacker must be positioned to deliver crafted negative responses rather than being able to exploit any default configuration freely. VulnCheck assigns a 'this_month' decision label - meaningful but below act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or widespread exploitation; exploitation status is 'no public exploit identified at time of analysis.' This is a genuine but second-order integrity weakness (an exploitation enabler) rather than a standalone critical issue: treat it as a routine-cycle patch item, with the caveat that hickory-recursor had no fix available at advisory time.

An attacker able to supply crafted negative DNS responses (for example a malicious authoritative server, or an off-path attacker spoofing responses to the recursive resolver) returns an NXDOMAIN/NODATA answer that embeds additional records for domains outside the responding server's bailiwick. Because the Hickory recursive resolver does not strip these out-of-bailiwick records from negative responses, the extraneous data can be accepted, facilitating cache poisoning and easing exploitation of other DNSSEC verification weaknesses. No public exploit code was identified; the available references are vendor/GHSA advisories only.