DNS Response Validation Bypass in Hickory DNS by Hickory Networks

CVE-2026-123578

What is CVE-2026-123578?

The Hickory DNS software, versions 0.26.0 to 0.26.2, along with Hickory Proto versions 0.25.0 to 0.25.2, exhibit a vulnerability where the UDP response's question section does not match the query when it has an empty question section (QDCOUNT=0). This oversight allows remote attackers to inject spoofed UDP responses that can escape validation checks, exposing systems to the risk of DNS spoofing attacks. The vulnerability undermines the integrity of DNS responses, highlighting the need for immediate action to ensure that systems are updated to the latest versions.

References