Hickory DNS CVE-2026-123591

Exploitation requires the resolver to perform DNSSEC validation and to process a delegation at a zone cut where the attacker can supply NSEC or NSEC3 records reused from the child side of the zone. The attacker must be able to inject or spoof DNS responses to the Hickory DNS resolver (on-path or capable of response forgery), which - combined with AC:H/AT:P - is the limiting factor: this is not trivially exploitable against arbitrary queries. Affected: hickory-net 0.26.0-beta.1 through 0.26.1 (fixed in 0.26.2) and hickory-proto through 0.26.0-alpha.1 (not yet patched). Deployments not using DNSSEC validation are not exposed to this specific downgrade.

This is a genuine DNSSEC security control failure with signals that point to moderate-but-real risk rather than an inflated high-CVSS issue. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) shows a network-reachable, unauthenticated flaw, but tempers it with AC:H and AT:P - exploitation requires specific attacker positioning and preconditions, not a trivial single packet. Impact is scoped tightly to integrity (VC:N/VI:H/VA:N): the bug lets an attacker defeat DNSSEC's proof-of-insecure-delegation and forge child-zone records, with no direct confidentiality or availability impact. The vuln.today priority is 'this_week' and it was reported by VulnCheck, indicating analyst attention, but it is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. No verified working exploit code is referenced - only the GHSA and VulnCheck advisories. The signals are internally consistent (a sophisticated spoofing/forgery primitive requiring an attacker able to inject DNS responses), so this reads as a prioritize-and-patch item for Hickory DNS deployments relying on DNSSEC validation, not an emergency. Key gaps: no EPSS, no KEV, and no independent confirmation of in-the-wild use.

An attacker positioned to inject or spoof DNS responses to a resolver using Hickory DNS supplies NSEC/NSEC3 records taken from the child side of a zone cut to falsely prove that no DS RRset exists, making a secure delegation appear insecure. Having downgraded validation, the attacker then forges arbitrary records in the child zone that the resolver accepts as valid. No public exploit identified at time of analysis; the GHSA advisory describes the mechanism but no verified working exploit code is referenced.