Vulnerability Description
Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj
- https://www.vulncheck.com/advisories/hickory-dns-through-0.25.0-alpha.3-dnssec-v
FAQ
What is CVE-2026-123605?
CVE-2026-123605 is a vulnerability with a CVSS score of 8.8 (HIGH). Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appear...
How severe is CVE-2026-123605?
CVE-2026-123605 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-123605?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.