Hickory DNS CVE-2026-123590

The target must be a validating resolver using hickory-net 0.26.0-beta.1 through 0.26.1, or hickory-proto at or below 0.26.0-alpha.1, with DNSSEC validation active. The attacker must be able to supply DNS responses to that resolver - an on-path/MITM position, a malicious or attacker-controlled upstream/authoritative server - and must craft an authority section that mixes at least one validly-signed same-name record with bogus NSEC or NSEC3 records of a different type for the same owner name. Limiting factors: exploitation is impossible without DNSSEC validation enabled and without a response-injection position (captured by AT:P), which bounds realistic risk below the unqualified network-attacker reading of the vector; no authentication is required (PR:N). hickory-net is fixed in 0.26.2, while hickory-proto is not yet patched.

Signals point to a genuine but mid-tier priority rather than an emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 (Medium): network-reachable and unauthenticated, but AT:P reflects a real attack requirement - the attacker must be positioned to supply DNS responses to the victim resolver (on-path, a malicious/forwarded upstream, or a controlled authoritative server). Impact is limited to integrity and availability of DNS answers (VI:L/VA:L) with no confidentiality exposure (VC:N). KEV status is not listed in the input, so there is no confirmed active exploitation; no EPSS score was provided, so widespread-exploitation probability cannot be quantified from this data. No PoC or exploit reference is present (only vendor/CVE advisories), so no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' - remediate on a normal patch cycle, not an act_now/emergency footing. Note one data discrepancy: NVD lists CWE-347 while the GHSA lists CWE-345/CWE-358 - all describe improper cryptographic/origin validation, so the characterization is consistent even though the identifiers differ. Net: a real DNSSEC-validation-bypass worth patching promptly, but the AT:P positioning requirement and absence of KEV/EPSS/PoC argue against treating it as a drop-everything issue.

An attacker able to supply DNS responses to a hickory-based validating resolver returns an authority section that mixes validly-signed records with bogus NSEC or NSEC3 records sharing the same owner name but a different type; because the code accepts the NSEC/NSEC3 set when any one same-name record passes signature validation, the forged denial record is trusted. The attacker thereby forges a nonexistence proof, convincing the resolver that a name or record type does not exist and suppressing or spoofing a DNSSEC-protected answer. No public exploit code is identified; success requires a response-injection or on-path position (reflected by AT:P).