CVE-2026-123605

Summary

The vulnerability allows attackers controlling any secure DNS zone to forge valid DNSSEC signatures for records in unrelated zones by exploiting improper zone boundary validation during RRSIG verification. This enables DNSSEC validation bypass, leading to potential cache poisoning or redirection of traffic to malicious destinations.

Exploitability

Exploitation requires the attacker to control a secure (DNSSEC-signed) zone and craft malicious responses with forged RRSIGs referencing their own zone's DNSKEY in the Signer's Name field; network position and zone control are required preconditions.

Blast radius

Affected resolvers, recursors, and clients using DnssecDnsHandle will accept forged records as authenticated, potentially compromising security for all downstream consumers of DNS data from those systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade hickory-net to version 0.26.2 or later, or upgrade hickory-proto to version 0.25.0-alpha.4 or later, where the zone boundary check has been implemented.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.