The vulnerable resolving and forwarding components of Hickory DNS do not verify that the SOA record they include in NXDOMAIN or NODATA responses actually passed DNSSEC validation, a flaw classified as CWE-345: Incorrect Validity Testing of an External Resource. An attacker who can inject forged DNS replies can cause the server to return a fabricated SOA record with the AD flag set, making clients believe the server has validated the data. This weakness allows an attacker to falsely claim DNSSEC authentication, potentially leading to mis‑trusted domain information or denial of service for clients relying on the server’s validation.

The affected product is Hickory DNS (hickory-dns) version 0.25.0 through 0.26.1, before the patch was released in 0.26.2.

The vulnerability has a CVSS score of 6.3, indicating moderate severity, and there is no EPSS score available. It is not listed in the CISA KEV catalog. The likely attack vector is a remote network attacker who can send forged DNS responses to the vulnerable server; the attacker does not need local access but must target the server’s DNS port. Successful exploitation would allow the attacker to surface forged DNSSEC‑authenticated SOA records to clients.