Hickory DNS EUVD-2026-119353

Exploitation requires three conditions to hold simultaneously: (1) the target must run Hickory DNS as a DNSSEC-validating resolver using hickory-proto <= 0.26.0-alpha.1 or hickory-net 0.26.0-beta.1 through 0.26.1; (2) the attacker must occupy an on-path position capable of intercepting and modifying DNS responses in transit (reflected as AT:P in the CVSS 4.0 vector); and (3) the targeted query must correspond to a name that genuinely exists as an empty non-terminal, so that the zone returns a signed NODATA response whose covering NSEC's Next Domain Name is a strict descendant of the query name. The core limiting factor is the on-path requirement - a purely off-path or blind attacker cannot trigger this, which substantially narrows realistic exploitation despite PR:N/UI:N. No authentication and no user interaction are required once the on-path position is held.

This is a moderate-severity DNSSEC denial-of-existence bypass, not a high-urgency emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 and is internally consistent with the description: PR:N reflects that no authentication is needed, but AT:P (attack requirements present) correctly captures the gating precondition that the attacker must hold an on-path position between the validating resolver and the authoritative server. Impact is limited to VI:L/VA:L with VC:N - there is no confidentiality exposure and no code execution; the attacker can only forge nonexistence of a name that genuinely exists as an empty non-terminal. No EPSS score, no CISA KEV listing, and no proof-of-concept exploit were provided, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month,' consistent with a real-but-not-emergency priority. The notable caveat is patch availability: hickory-net is fixed in 0.26.2, but hickory-proto is listed as 'not yet patched,' so consumers of hickory-proto <= 0.26.0-alpha.1 cannot fully remediate from the data provided. The 'Information Disclosure' tag conflicts with the CVSS vector (VC:N) - this is a data-authenticity/spoofing flaw (CWE-345), not confidentiality loss.

An on-path attacker (for example, on a shared network segment or controlling an intermediate router between the resolver and the authoritative server) intercepts a zone's genuine signed NODATA response and flips only the unsigned rcode field in the DNS header from NOERROR to NXDOMAIN. Because RRSIGs do not cover the DNS header, every signature still validates, and the Hickory NSEC validator returns Proof::Secure, so the validating resolver accepts forged nonexistence of a name that actually exists as an empty non-terminal. No public proof-of-concept exploit was identified in the provided data.