{"id":"CVE-2026-123590","aliases":[],"cve":{"records":[{"id":"CVE-2026-123590","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:57:31.045Z","published":"2026-11-08T01:38:21.651Z","modified":"2026-11-09T13:51:06.791Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:21.651Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:51:06.791Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-improper-nsec-nsec3-signature-validation","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-347","description":"Improper Verification of Cryptographic Signature","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:50:57.812771Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validation","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.","score":6.3,"severity":"medium","published":"2026-11-08T01:38:21.651Z","modified":"2026-11-09T13:51:06.791Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.26.0-beta.1","status":"affected","lessThan":"0.26.2","versionType":"semver"},{"version":"0.26.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-net","packageIdentity":{"ecosystem":"crates.io","name":"hickory-net"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123590"},{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.26.0-alpha.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-proto","packageIdentity":{"ecosystem":"crates.io","name":"hickory-proto"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123590"}],"remediation":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6","https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-improper-nsec-nsec3-signature-validation"],"sources":[{"name":"CVE","id":"CVE-2026-123590","modified":"2026-11-09T13:51:06.791Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123590"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":6.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","score":4.8}],"sourceAffected":[],"observedAt":"2026-11-09T13:55:45.069Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:25:32.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T02:20:34.912Z","attemptedAt":"2026-11-08T02:20:34.912Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:20:35.320Z","attemptedAt":"2026-11-08T02:20:35.320Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:20:35.407Z","attemptedAt":"2026-11-08T02:20:35.407Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:20:34.786Z","attemptedAt":"2026-11-08T02:20:34.786Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-123590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123590","modified":"2026-11-08T02:16:53.097","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T02:20:34.912Z"},{"source":"NVD","id":"CVE-2026-123590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123590","modified":"2026-11-08T02:16:53.097","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-11-08T02:20:34.912Z"}],"aiSummary":{"text":"Hickory DNS versions 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 have an improper signature validation weakness, allowing attackers with DNS response supply access to forge nonexistence proofs. The weakness is due to accepting NSEC and NSEC3 records when other records with the same owner name pass signature validation.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T02:11:29.772Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123590"}]}}