DNSSEC Validation Bypass in Hickory DNS Software by Hickory

CVE-2026-123605

What is CVE-2026-123605?

The Hickory DNS software versions from 0.1 through 0.25.0-alpha.3, along with the hickory-net prior to version 0.26.2, are subject to a critical security flaw that enables a DNSSEC validation bypass. This vulnerability arises when the DNSSEC validator improperly verifies an RRSIG against the DNSKEY present in the Signer's Name field without confirming that this name correlates to the zone containing the resource record set (RRset). Consequently, attackers who have control over any secure zone can generate valid signatures for arbitrary records across unrelated zones. This means that DNS resolvers, recursors, and clients utilizing DnssecDnsHandle may mistakenly accept these unauthorized signatures as genuine, thereby compromising the integrity of DNS responses.

References