---
id: CVE-2026-123605
title: >-
  Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's
  Name
summary: >-
  Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before
  0.26.2 contain a DNSSEC validation bypass because the validator verifies an
  RRSIG against the DNSKEY of whatever name appears in its Signer's Name field
  without …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-347
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns >= 0.1 <= 0.25.0-alpha.3
  - hickory-dns >= 0.26.0-beta.1 < 0.26.2
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:32.045Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123605'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c
    label: GitHub Security Advisory (GHSA-2vgh-3wfw-qj7c)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-through-0.25.0-alpha.3-dnssec-validation-bypass-via-rrsig-signer-s-name
    label: >-
      VulnCheck Advisory: Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation
      Bypass via RRSIG Signer's Name
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.640Z'
---

## Overview

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.

## Affected

- `hickory-dns >= 0.1 <= 0.25.0-alpha.3`
- `hickory-dns >= 0.26.0-beta.1 < 0.26.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.