DNSSEC Validation Bypass in Hickory DNS Resolver
CVE-2026-123582

6.3MEDIUM

Key Information:

Vendor

Hickory-dns

Status
Hickory-dns
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123582?

The Hickory DNS resolver and forwarder versions prior to 0.26.2 are susceptible to a vulnerability where they fail to properly validate the SOA (Start of Authority) record when processing NXDOMAIN or NODATA responses. This issue allows an attacker to inject forged DNS responses, misleading clients into believing that the server has validated those records via DNSSEC. As a result, clients relying on the server for DNS resolution may receive inaccurate information, undermining the integrity of domain resolution processes.

Affected Version(s)

hickory-dns 0.25.0 < 0.26.2

hickory-dns 0.26.2

References

https://github.com/hickory-dns/hickory-dns/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/hickory-dns-0.25.0-b...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

qifan-sailboat
.