{"id":"CVE-2026-123593","aliases":[],"cve":{"records":[{"id":"CVE-2026-123593","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:57:31.045Z","published":"2026-11-08T01:38:23.719Z","modified":"2026-11-10T17:57:27.374Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:23.719Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T17:57:27.374Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-trustanchors","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-1023","description":"Incomplete Comparison with Missing Factors","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T15:41:59.064360Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchors","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.","score":6.3,"severity":"medium","published":"2026-11-08T01:38:23.719Z","modified":"2026-11-10T17:57:27.374Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.26.0-beta.1","status":"affected","lessThan":"0.26.2","versionType":"semver"},{"version":"0.26.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-net","packageIdentity":{"ecosystem":"crates.io","name":"hickory-net"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123593"},{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.24.0","status":"affected","lessThanOrEqual":"0.26.0-alpha.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-proto","packageIdentity":{"ecosystem":"crates.io","name":"hickory-proto"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123593"}],"remediation":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9","https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-trustanchors"],"sources":[{"name":"CVE","id":"CVE-2026-123593","modified":"2026-11-10T17:57:27.374Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123593"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":6.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","score":4.8}],"sourceAffected":[],"observedAt":"2026-11-10T18:16:41.834Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:25:32.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T02:20:31.315Z","attemptedAt":"2026-11-08T02:20:31.315Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:20:31.895Z","attemptedAt":"2026-11-08T02:20:31.895Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:20:31.315Z","attemptedAt":"2026-11-08T02:20:31.315Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:20:31.315Z","attemptedAt":"2026-11-08T02:20:31.315Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-123593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123593","modified":"2026-11-08T02:16:53.563","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T02:20:31.315Z"},{"source":"NVD","id":"CVE-2026-123593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123593","modified":"2026-11-08T02:16:53.563","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-11-08T02:20:31.315Z"}],"aiSummary":{"text":"Hickory DNS versions 0.26.0-beta.1 before 0.26.2 and 0.24.0 through 0.26.0-alpha.1 have a DNSSEC validation bypass weakness. Attackers with name server response control can replace a secure zone's DNSKEY RRset.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T02:11:22.894Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123593"}]}}