{"id":"CVE-2026-123605","published":"2026-11-08T02:16:55.423","lastModified":"2026-11-10T22:15:59.797","description":"Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c","tags":[]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.25.0-alpha.3-dnssec-validation-bypass-via-rrsig-signer-s-name","tags":[]}],"exploitRefs":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers controlling any secure DNS zone to forge valid DNSSEC signatures for records in unrelated zones by exploiting improper zone boundary validation during RRSIG verification. This enables DNSSEC validation bypass, leading to potential cache poisoning or redirection of traffic to malicious destinations.","exploitability":"Exploitation requires the attacker to control a secure (DNSSEC-signed) zone and craft malicious responses with forged RRSIGs referencing their own zone's DNSKEY in the Signer's Name field; network position and zone control are required preconditions.","blast_radius":"Affected resolvers, recursors, and clients using DnssecDnsHandle will accept forged records as authenticated, potentially compromising security for all downstream consumers of DNS data from those systems.","remediation":"Upgrade hickory-net to version 0.26.2 or later, or upgrade hickory-proto to version 0.25.0-alpha.4 or later, where the zone boundary check has been implemented.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dnssec-bypass","validation-flaw","caching-poisoning","network-protocol"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:54:13.096Z"}}