Hickory DNS CVE-2026-123605

Exploitation requires the target to be a Hickory DNS resolver, recursor, or client that calls DnssecDnsHandle, is compiled with the dnssec-ring or dnssec-aws-lc-rs feature, and is configured to perform DNSSEC validation - if DNSSEC validation is not enabled, the vulnerable code path is not reached. The attacker must control at least one secure (DNSSEC-signed) zone in the public DNS to mint valid RRSIGs; purely passive or zone-less attackers cannot trigger it. These are the limiting factors (feature compiled in, validation enabled, attacker operating a signed zone); no end-user interaction or privilege on the victim resolver itself is needed. Affected: hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net v0.26.0-beta.1 through 0.26.1.

This is a genuine, high-impact integrity failure rather than an inflated CVSS score: CWE-347 improper signature verification that silently defeats the core guarantee of DNSSEC. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7 High) is consistent with the mechanism - a validator that accepts an RRSIG whose Signer's Name points to any attacker-controlled secure zone, violating RFC 4035 §5.3.1. PR:L reflects a real but low barrier: the attacker must operate a DNSSEC-signed zone in the public DNS, not merely send packets. No EPSS score, KEV listing, or exploit-code reference is present in the input, so exploitation is not demonstrated in the wild - no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), which matches the picture: cryptographically trivial for any zone operator and broadly damaging where DNSSEC validation is enabled, but gated behind an opt-in feature/configuration and no evidence of mass exploitation. Priority is driven by impact and ease of signature forgery, not by observed campaigns. Reported by VulnCheck and confirmed by the vendor GHSA advisory.

An attacker who registers and DNSSEC-signs their own zone crafts an RRSIG whose Signer's Name points at that attacker zone but which covers forged records (e.g. an A record) for a victim name in an unrelated zone. A Hickory-based resolver, recursor, or client performing DNSSEC validation fetches the attacker's DNSKEY, verifies the signature successfully, and returns the forged records as authenticated - enabling DNS spoofing and traffic redirection over the network with low complexity. No public exploit code is identified in the provided sources, though the technique is straightforward for any zone operator.