The flaw in the hickory DNS libraries causes any signed RRset in the answer section to be treated as a valid positive response, even when it does not match the query. This means an attacker can inject unrelated signed records and force the resolver to accept them as authoritative, enabling DNS spoofing and potentially redirecting traffic to malicious sites or exfiltrating data. The weakness lies in improper DNSSEC validation logic (CWE‑345).

This issue affects the hickory-dns library, specifically the hickory‑proto component up to version 0.26.0‑alpha.1 and the hickory‑net component up to version 0.26.0‑beta.1, before the 0.26.2 release. Systems that use these prerelease packages for DNS resolution are exposed.

With a CVSS score of 6.9 the vulnerability is considered medium severity; the EPSS score is not available, and it is not yet listed in the CISA KEV catalog. The likely attack vector is network‑based, requiring the attacker to send crafted DNS responses to a resolver relying on the vulnerable library. Since the flaw only bypasses validation, exploitation does not grant remote code execution but can lead to credential theft and traffic diversion.