CVE-2026-123605

Name of the Vulnerable Software and Affected Versions hickory-proto versions 0.1 through 0.25.0-alpha.3 hickory-net versions prior to 0.26.2

Description A DNSSEC validation bypass exists where the validator verifies an RRSIG against the DNSKEY of any name found in the Signer's Name field without confirming that the name belongs to the zone containing the RRset. This allows attackers who control a secure zone to create valid signatures for arbitrary records in unrelated zones. These forged records are then accepted as authenticated by resolvers, recursors, and clients utilizing the DnssecDnsHandle function.

Recommendations Update hickory-proto to version 0.25.0-alpha.4 or later. Update hickory-net to version 0.26.2 or later.