Hickory DNS CVE-2026-123595

Hickory must be deployed as a DNSSEC-validating recursive resolver, since the defect is in the validating recursor's NSEC3 NXDOMAIN/NODATA handling. The attacker must be able to deliver one crafted response to the resolver - practical paths named in the advisory are on-path interception, operating a rogue/misbehaving parent or authoritative nameserver, or winning an off-path UDP source-port+TXID race. No key compromise and no authentication to the zone are required because the forged response reuses genuinely signed, publicly retrievable parent-side NSEC3 records (those the parent already serves on child./DS queries). Limiting factors: the deployment must be a validating recursor (not a stub or non-validating resolver), the attacker needs a response-injection position, and the effect is bounded to names at and below the target zone cut and persists only for the cached negative TTL.

The supplied CVSS 4.0 vector rates this 8.7 (High) with AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/VI:H/VA:H, but the VC:H (confidentiality) rating is hard to justify from the evidence: the flaw yields forged, AD=1-authenticated denial-of-existence (NXDOMAIN/NODATA), which is an integrity and availability problem, not data disclosure. The concrete impact is denial of resolution for names that legitimately exist at and below a zone cut, cached for the negative TTL. Exploitation requires an attacker able to inject one response - on-path, a rogue/misbehaving parent or authoritative nameserver, or winning an off-path source-port+TXID race; the race path raises complexity while the rogue-parent/on-path paths are low-complexity. No EPSS score, no CISA KEV listing, and no confirmed working exploit code are present in the input, so there is no signal of widespread active exploitation yet; vuln.today assigns a 'this_week' priority rather than act_now/emergency. Net: a credible, genuine DNSSEC-validation bypass that warrants prompt patching for anyone running Hickory as a validating recursor, but blast radius is bounded by a niche deployment footprint and the need for a privileged network position. Note: PR:L in the supplied vector conflicts with the description, which describes an unauthenticated network attacker rather than an authenticated one - verify with vendor.

An attacker acting as a rogue/misbehaving parent nameserver, on-path, or by winning an off-path port+TXID race delivers a single DNS response assembled from the parent zone's genuinely signed ancestor-delegation NSEC3 records (no key compromise needed). Hickory's validating recursor matches the closest encloser by NSEC3 hash without inspecting the type bitmap, accepts the parent-side NSEC3 as proof of nonexistence, and caches an NXDOMAIN/NODATA with AD=1, so every subsequent client query for names at and below the zone cut is denied for the negative TTL. No confirmed public exploit code is identified at time of analysis.