The vulnerability in Hickory DNS 0.26.0-beta.1 through 0.26.1 allows an attacker controlling an unsigned DNS delegation to cause the resolver to skip DNSSEC signature verification. By manipulating only the dot positions in a domain name, an attacker can force the name hash used for validation to collide with that of a signed target. The cache key relies solely on this hash, so the resolver accepts an insecure verdict and returns forged answers as if they were valid, instead of propagating a SERVFAIL. This flaw enables an attacker to generate spoofed DNS records that can be used to redirect traffic or conduct phishing and credential‑stealing attacks, compromising the integrity of DNS data.

Hickory DNS 0.26.0-beta.1 up to but not including 0.26.2, distributed via the hickory-dns:hickory-dns vendor identifier. Users deploying these versions as DNS resolver libraries are susceptible; clients relying on these resolvers may receive invalid responses.

The CVSS score of 8.2 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exploitation likelihood is unclear but the impact if exploited is significant. The attack vector is inferred to be remote network-based, requiring an attacker to supply malicious DNS delegations that the resolver will process. No mitigations such as workarounds are publicly listed, and the only official remedy is the upstream patch that fixes the hash collision handling.