Advisory · CVE-2026-123605
Hickory DNSSEC trusts signatures from any zone, letting attackers forge authenticated records
Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset, letting attackers controlling any secure zone produce valid signatures over arbitrary records in unrelated zones, rated high at CVSS 8.8; fixed in 0.26.2.
- Vendor
- hickory-dns
- Product
- Hickory DNS
- Identifier / CWE
- CVE-2026-123605
CWE-347 - Action timing
- Immediate
Explain it like I’m five
DNSSEC signatures are supposed to prove a record comes from its own zone. Hickory checks the signature against whichever zone the signature names, so an attacker who owns any signed zone can stamp their own records as genuine for any other zone.
- 01Attacker controls a secure zone
The attacker holds valid DNSSEC keys for any signed zone.
- 02Records signed for another zone
The attacker signs arbitrary records in an unrelated zone with their own keys.
- 03Signer name trusted
The validator checks the RRSIG against the named signer's DNSKEY without confirming that name is the zone containing the RRset.
- 04Forged records accepted
Resolvers, recursors, and clients using the validating handler accept the records as authenticated.
What happened
Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer’s Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using the validating handler accept as authenticated. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
This breaks the core promise of DNSSEC: a signature is only meaningful if it comes from the zone that owns the name. Any signed zone becomes a signing oracle for every other zone. The flaw is fixed in 0.26.2.
What to do
- Inventory applications and services using Hickory DNS crates and record each version.
- Upgrade hickory-proto and hickory-net to 0.26.2 or later.
- Review resolver logs for records authenticated by unexpected signer names.
- Monitor for DNS answers that conflict with authoritative data.
- Verify the deployed crate versions after updating.
Management note
A DNSSEC bypass where any zone owner can forge any record is a trust failure, not a parsing bug. Treat cached answers from the exposure window as untrusted until the upgrade lands.