Hickory DNS CVE-2026-123601

Exploitation requires two concrete conditions: (1) the targeted Hickory deployment must have DNSSEC validation enabled - the advisory states it affects any Hickory DNS configuration using DNSSEC validation, and non-validating resolvers are unaffected; and (2) the attacker must be able to inject DNS responses into the resolver's path, i.e. an on-path/MITM position or off-path spoofing that wins the response race (reflected by AT:P in the CVSS 4.0 vector). A further precondition, trivially satisfied, is obtaining the victim zone's wrap-around (last-in-hash-ring) NSEC3 record and its RRSIG, which are ordinary queryable DNSSEC records. Limiting factors for defenders: no exposure without DNSSEC validation, the required response-injection capability (not pure off-path-free remote), and that affected versions are the specific hickory-net 0.26.0-beta.1..0.26.1 and hickory-proto 0.25.0..0.26.0-alpha.1 ranges.

The CVSS 4.0 base score is 8.3 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and impact concentrated on VA:H (high availability) and VI:L (low integrity), no confidentiality impact (VC:N) and no scope/subsequent-system change (SC:N/SI:N/SA:N). The signals are internally consistent: the flaw is reachable over the network without privileges or user interaction, but the AT:P (attack requirement) metric correctly captures that exploitation is not unconditional - the attacker must be positioned to inject DNS responses, i.e. on-path (MITM) or off-path with successful spoofing. This single prerequisite is the dominant factor distinguishing this from a purely trivial remote bug. VulnCheck's decision label is 'this_week', indicating elevated but not emergency urgency. This is NOT in CISA KEV, no EPSS score was provided, and no confirmed public exploit was supplied - so there is no evidence of active or at-scale exploitation; the priority is driven by severity and the clean DNSSEC-forgery primitive rather than observed attacks. Missing signals to note explicitly: EPSS probability is absent, KEV status is absent (treat as not listed), and POC/working-exploit status is unknown from the provided references (only advisories were supplied). Net assessment: a credible, high-severity DNSSEC-validation defeat that is a real near-term priority specifically for deployments doing DNSSEC validation, tempered by the response-injection precondition.

An attacker able to inject DNS responses toward a Hickory-based validating resolver (on-path, or off-path via spoofing) first queries the victim zone to obtain its legitimate wrap-around (last) NSEC3 record and matching RRSIG. Because find_covering_record() has its wrap-around comparison operators inverted, that one record is treated as covering nearly every hash in the zone, so the attacker replays it inside a forged negative response and Hickory accepts a DNSSEC-validated proof of nonexistence for names that actually exist. No public working exploit is identified at time of analysis, though the GHSA advisory describes the flaw and trigger precisely.