Hickory DNS's verify_rrsets() function disregards DNS class information when segregating resource record sets, creating a DNSSEC validation bypass (CWE-345). As a result, records of classes other than IN are not subjected to DNSSEC signature verification, yet they are treated as secure after IN records pass validation. An attacker who can inject custom DNS responses can supply forged CH or HS class records, including DS records, which are accepted as valid. This capability lets an adversary authenticate arbitrary DNSKEYs and craft child zone responses that appear legitimate, undermining DNSSEC’s core purpose of authenticating domain data.

The issue exists in hickory-proto prior to version 0.26.0‑beta.1 and in hickory-net prior to 0.26.2. Systems that use these libraries for DNS resolution or DNSSEC validation are vulnerable, which includes any applications or services that rely on the affected hickory-dns versions for DNS queries.

Based on the description, it is inferred that an attacker who can inject forged DNS responses—such as through a compromised resolver, malicious gateway, or controlled network segment—could exploit the bypass by injecting non‑IN class records, thereby subverting DNSSEC validation for the target system. The CVSS score of 6.3 signifies a moderate severity risk. No EPSS score is published, and the vulnerability is not listed in CISA’s KEV catalog.