Hickory DNS CVE-2026-123593

Requires that the attacker can spoof or control DNS name server responses seen by the Hickory resolver (on-path MITM, or a malicious/compromised upstream name server); it is not exploitable by a purely off-path attacker with no response control. The defect is in DNSSEC validation via TrustAnchors, so the resolver must be performing DNSSEC validation against configured trust anchors. Affected: hickory-net 0.26.0-beta.1 up to (not including) 0.26.2, and hickory-proto 0.24.0 through 0.26.0-alpha.1. Limiting factors that reduce realistic risk: the forgery is confined to the DNSKEY RRset - the attacker cannot forge other signed records without the corresponding private keys - and the position needed to inject responses (AT:P) is a meaningful barrier; persistence depends on the attacker setting a large TTL so the poisoned RRset stays cached.

This is a genuine but bounded DNSSEC validation flaw rather than a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 (Medium): network-reachable and unauthenticated (PR:N), but AT:P reflects the real gating condition - the attacker must be able to spoof or control name server responses (on-path or a malicious/compromised resolver), which is not a default position. Impact is deliberately limited: VC:N (no confidentiality loss) and only VI:L/VA:L, because an attacker can tamper the DNSKEY RRset by substituting the root zone's trusted keys, but cannot forge any further records (that would require the private keys). The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a moderate priority. No EPSS score, no CISA KEV listing, and no working exploit code were provided in the input, so exploitation probability cannot be quantified from the data; absence of these is not evidence of safety but does argue against widespread opportunistic attacks. Net: treat as a real correctness/integrity bug in DNSSEC enforcement worth patching this cycle, not a high-CVSS paper tiger nor a critical remote-code-execution class risk.

An attacker positioned to spoof DNS responses (on-path) or operating a malicious/compromised name server returns a secure zone's DNSKEY RRset in which every DNSKEY is replaced with the root zone's trusted public keys. Because Hickory compares keys against trust anchors without checking the DNSKEY record's owner name, the RRset is accepted without any RRSIG verification, and a large TTL keeps the poisoned keys cached well past the initial spoofing window. No public exploit code was identified at time of analysis; the trigger mechanism is described directly in the vendor advisory.