Hickory DNS CVE-2026-123599

Exploitation requires the attacker to be able to supply DNS responses to a Hickory-based validating resolver - e.g. an on-path/MITM position, a malicious or compromised upstream resolver, or a controlled authoritative server - matching the AT:P (attack requirements) flag; it is not blind remote-from-anywhere exploitation. The response must contain a genuinely validating IN-class RRset alongside the forged CH or HS class records (including a forged DS), since the non-IN records only inherit 'secure' status when the IN records verify. Affected code paths are hickory-proto before 0.26.0-beta.1 and hickory-net 0.26.0-beta.1 through 0.26.1 with DNSSEC validation in use. Limiting factors: the on-path/response-injection requirement, the integrity-only (no confidentiality or availability) impact, and the advisory's note that real-world impact depends on how downstream systems handle records with unexpected DNS classes.

This is a moderate-severity DNSSEC validation bypass (CVSS 4.0 base 6.3, vendor-provided) in the Hickory DNS Rust implementation. The vector AV:N/AC:L/AT:P/PR:N/UI:N tells a consistent story: it is reachable over the network by an unauthenticated attacker, but the AT:P (attack requirements present) flag reflects the real precondition stated in the advisory - the attacker must be able to supply DNS responses to the resolver (on-path/MITM position, a malicious upstream, or a controlled authoritative server). Impact is integrity-only and rated low (VI:L; VC:N/VA:N), because the practical consequence depends on how downstream systems treat records with an unexpected DNS class. No EPSS score, CISA KEV listing, or working exploit is present in the input, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month', i.e. a prioritized-but-not-emergency fix. The main caveat: although the raw impact is scored low, the mechanism is serious - forging a DS record with a non-IN class lets an attacker authenticate any DNSKEY and forge any child-zone response, which could in principle be leveraged into higher-impact spoofing depending on downstream handling. Treat the low integrity score as the vendor's conservative floor, not a ceiling. No conflicting signals were observed between the CVSS vector and the description.

An attacker positioned to supply DNS responses to a Hickory-based resolver (on-path interception or a malicious/compromised upstream) returns a response whose IN-class records verify correctly but which also carries forged CH or HS class records - including a forged DS record. Because verify_rrsets() partitions RRsets without considering DNS class, the non-IN records bypass signature verification yet inherit the 'secure' status of the validated IN records, allowing the attacker to authenticate an arbitrary DNSKEY and forge child-zone data. No public exploit is identified at time of analysis; the attack requires the ability to inject responses rather than purely remote blind interaction.