DNSSEC Validation Bypass in Hickory DNS Products by Hickory

CVE-2026-123599

What is CVE-2026-123599?

Hickory DNS and hickory-net versions prior to 0.26.0-beta.1 and 0.26.2 respectively, exhibit a vulnerability that allows a DNSSEC validation bypass due to the verify_rrsets() function improperly ignoring the DNS class during RRset partitioning. This oversight permits attackers to exploit DNS responses by injecting forged CH or HS class records, including DS records, enabling the authentication of any DNSKEY and manipulating responses from child zones, thus compromising the integrity of DNS communications.

References