Hickory DNS EUVD-2026-119355

Prerequisite: the target must be running the Hickory DNS validating recursor with DNSSEC validation enabled (affected: hickory-proto <= 0.26.0-alpha.1, and hickory-net 0.26.0-beta.1 through 0.26.1). The attacker must deliver exactly one forged NXDOMAIN response whose proof is the parent zone's genuinely signed ancestor-delegation NSEC at the zone cut - this requires either an on-path/MITM position between the recursor and the parent, operation of a rogue parent or TLD nameserver in the delegation path, or winning a source-port + TXID race against the legitimate parent response. Limiting factors: the forged denial only covers names strictly below a zone cut where such a parent NSEC exists; the poisoning persists only for the cached negative TTL; no key compromise or resolver credentials are needed; and the off-path race variant is materially harder than the on-path or rogue-parent paths. The advisory also notes related variants affecting wildcard-nonexistence proofs in NOERROR responses and DNAME names.

Multiple signals point to a genuine but scoped priority rather than a mass-exploitation emergency. The vuln.today decision label is this_week (not act_now/emergency), it is NOT listed in CISA KEV, and no EPSS probability was supplied, so there is no evidence of active or widespread exploitation. The supplied CVSS 4.0 base score is 8.7 (High) with AV:N/AC:L/AT:N/PR:L and VC:H/VI:H/VA:H. Two of those input metrics are worth challenging: (1) VC:H (high confidentiality) overstates the impact - the flaw forges proof of NON-existence (a signed NXDOMAIN with AD=1) for names that really exist; nothing is disclosed, so this is an integrity/denial issue, not a confidentiality one. (2) PR:L is misleading in CVSS terms - the attacker needs no credentials on the resolver; they need a network position (on-path), control of a rogue parent/TLD nameserver, or to win a port+TXID race. Treat the realistic attacker as an unauthenticated network/on-path adversary, and note that the off-path race path is substantially harder than the on-path or rogue-parent paths. Exploitation status: no public exploit identified at time of analysis (the only references are the GHSA and VulnCheck advisories, not PoC/exploit code). Patch posture is split and raises urgency for one component: hickory-net is fixed in 0.26.2, but hickory-proto (<= 0.26.0-alpha.1) is explicitly 'not yet patched', so proto consumers currently have no fixed release. Net: real and worth patching this week for anyone running the Hickory validating recursor, but tempered by niche deployment, no confirmed exploitation, and no confidentiality loss.

An attacker who is on-path to a Hickory DNS validating recursor (or who operates a rogue parent/TLD nameserver) answers the resolver's delegation walk with a single NXDOMAIN built from the parent's genuinely signed ancestor-delegation NSEC at the zone cut. Because the NSEC handler treats that parent-side record as proof of nonexistence below the cut, the recursor marks the forged denial Proof::Secure and caches it under the (child., NS) key, so every client query for real names in that child zone returns an authenticated (AD=1) NXDOMAIN until the negative TTL expires. No key compromise is needed and no public exploit code is currently identified; AC is low for the on-path/rogue-parent delivery, higher if the attacker must instead win a port+TXID race.