Hickory DNS 0.26.0-beta.1 through 0.26.1 and earlier fails to differentiate NODATA responses from wildcard‑expanded positive responses during DNSSEC validation. An attacker can combine an NSEC3 record that matches the queried name with a signed wildcard record to produce a bogus positive response that the resolver accepts as valid. This flaw allows the attacker to bypass DNSSEC protection, enabling spoofed DNS data that can redirect traffic or facilitate phishing attacks.

Affect the Hickory DNS (hickory‑net) product line with versions 0.26.0‑beta.1 through 0.26.1 and the hickory‑proto implementation up to 0.26.0‑alpha.1. Both are distributed under the hickory‑dns vendor name and are listed as hickory‑dns:hickory‑dns in common enumeration records.

The vulnerability has a CVSS score of 6.3, indicating moderate severity. EPSS data is unavailable and the CVE is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. However, the weakness is exploitable remotely through normal DNS queries or by sending spoofed NSEC3 and wildcard records to a vulnerable resolver, meaning any network reliant on the affected DNS implementation could be compromised without prior authentication.