CVE-2026-123582

Name of the Vulnerable Software and Affected Versions Hickory DNS (hickory-server) versions 0.25.0 through 0.26.1

Description The validating recursive resolver and validating forwarder fail to verify if the SOA record passed DNSSEC validation when constructing NXDOMAIN or NODATA responses. This allows an attacker to provide forged DNS responses, resulting in clients receiving a forged SOA record with the AD bit set, which incorrectly indicates that the response has been validated.

Recommendations Update Hickory DNS (hickory-server) to version 0.26.2 or later.