DNSSEC Validation Bypass in Hickory DNS by Hickory Networks

CVE-2026-123591

What is CVE-2026-123591?

Hickory DNS versions prior to 0.26.2 and hickory-proto versions before 0.26.0-alpha.1 are susceptible to a DNSSEC validation bypass. This vulnerability arises from improper checks against RFC 6840 §4.4, allowing attackers to manipulate NSEC or NSEC3 records. Consequently, they can forge DNS records by creating an apparent insecure delegation without properly verifying the existence of the necessary NS record. This susceptibility could lead to malicious exploitation and potential compromise of child-zone security. Users are advised to update to the latest versions to mitigate this risk.

References