Hickory DNS CVE-2026-123587

Requires (1) hickory-net 0.26.0 or 0.26.1 acting as a DNSSEC-validating resolver, and (2) the attacker being able to supply DNS responses that reach that validator - a malicious or compromised upstream/forwarding resolver, an on-path interceptor, or successful response injection; a purely off-path blind spoofer that cannot get its response accepted does not meet this. The concrete trigger is the wraparound-NSEC coverage test, which identifies a wraparound NSEC (next domain name = zone apex) by comparing the next name to an SOA record in the response and accepts that SOA even with a failing validation result; the attacker supplies a genuine NSEC + its valid RRSIG plus a crafted bogus SOA. No authentication, privileges, or user interaction are needed (PR:N/UI:N). Limiting factors: only integrity of resolution is affected (no data disclosure or DoS of the service itself), the attacker must be able to deliver the response (AT:P), and non-validating or non-DNSSEC deployments are unaffected. Upgrading to 0.26.2 is the fix per the advisory.

This is a genuine integrity-focused flaw rather than a CVSS-inflated non-issue, but its real-world urgency is moderated by both the affected product's footprint and the attacker positioning it requires. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.9 and emphasizes high integrity impact to both the vulnerable system (VI:H) and downstream consumers (SI:H), with no confidentiality or availability impact - consistent with a DNSSEC validation bypass that forges nonexistence (NXDOMAIN/no-data) for arbitrary RRsets. The critical qualifier is AT:P (attack requirements present): the attacker must be able to supply DNS responses to the validating resolver, i.e. act as an on-path interceptor, a malicious/compromised upstream, or win a response-injection race - this is precisely the untrusted-response threat model DNSSEC exists to defeat, so a malicious authoritative/forwarding server meets it easily while a pure off-path spoofer does not. No EPSS score, KEV listing, or SSVC automatable/technical-impact fields were supplied in the input, so those signals cannot be weighed; the vuln.today Decision label is 'this_week' (not act_now/emergency), aligning with a serious-but-not-actively-exploited posture. No public exploit identified at time of analysis - only vendor/coordinator advisories (GHSA, VulnCheck) are referenced, not PoC or exploit code. Net: prioritize patching within the normal sprint per the 'this_week' label, weighted higher for anyone using hickory-net as a validating DNSSEC resolver in a position where untrusted responses can reach it.

An attacker able to supply DNS responses to a hickory-net resolver running DNSSEC validation (e.g. a malicious upstream resolver, on-path interceptor, or response injector) crafts a reply that pairs a genuine NSEC record and its valid RRSIG with a bogus, non-validating SOA record. Because the library identifies wraparound NSEC records by comparing the NSEC next domain name to an SOA that it accepts even when that SOA fails validation, the resolver is tricked into treating the NSEC as covering the queried name, forging authenticated denial of existence for any RRset the attacker chooses. No public exploit was identified at time of analysis; exploitation requires only the ability to deliver the crafted response, not special privileges or user interaction.