Hickory DNS versions from hickory-proto 0.1 up to 0.25.0-alpha.3 and hickory-net prior to 0.26.2 allow an attacker to bypass DNSSEC validation by exploiting the fact that the validator checks an RRSIG against the DNSKEY of the name in the Signer’s Name field without confirming that this name is the zone containing the RRset. This flaw enables a threat actor that controls any secure zone to sign arbitrary records for unrelated zones with valid signatures, causing resolvers, recursors, and clients that accept DnssecDnsHandle output to treat those forged records as authentic. The impact is a loss of DNSSEC integrity, exposing the system to DNS spoofing, cache poisoning, and inefficient routing decisions, potentially leading to service disruptions and data tampering.

These vulnerabilities affect the hickory-dns project. Specific versions impacted are hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2. Systems using these libraries for DNS resolution or DNSSEC validation may be at risk if they do not apply the latest updates or patches.

The CVSS score of 8.7 indicates a high severity, and although the EPSS score is not available, the nature of the flaw suggests moderate to high exploitability for attackers who control legitimate authoritative zones. The issue is not listed in the CISA KEV catalog. Attackers can prepare forged DNS records and Signer names in zones they manage, sending them to resolvers that use the vulnerable hickory-dns libraries. No public exploit is reported, but the conditions for exploitation are relatively simple and therefore the threat of real-world attacks is significant.