DNSSEC Validation Bypass Vulnerability in Hickory DNS by Hickory

CVE-2026-123593

What is CVE-2026-123593?

A vulnerability exists in Hickory DNS versions 0.26.0-beta.1 prior to 0.26.2 and Hickory Proto versions 0.24.0 through 0.26.0-alpha.1, where DNSKEY public keys are compared against DNSSEC trust anchors without verifying the DNSKEY record name. This flaw allows an attacker who can spoof DNS responses to substitute a secure zone's DNSKEY RRset with unverified keys from the root zone, potentially leading to unauthorized access and cache poisoning through prolonged TTLs. Users are urged to review and update their systems to mitigate this risk.

References