{"id":"CVE-2026-123593","kind":"vulnerability","aliases":["CVE-2026-123593"],"related":[],"title":"Hickory DNS: DNSSEC key check skips record name, accepting forged keys","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.","summary":"Hickory DNS resolver libraries compare DNSKEY keys against DNSSEC trust anchors without checking the record name, so a key set made only of trusted keys is accepted without signature verification. An attacker who can spoof or control name server responses can swap a secure zone's DNSKEY set for the root zone's keys and keep it cached with a long TTL.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["managed-dns-resolver","no-dnssec-validation"],"how_to_check":"- Check the version of `hickory-net` and `hickory-proto` in your lockfile or `Cargo.lock`.\n- Look for `hickory-net` `0.26.0-beta.1` or later beta builds before `0.26.2`, and `hickory-proto` between `0.24.0` and `0.26.0-alpha.1`.","fix":"- `hickory-net`: move to `0.26.2` or later.\n- `hickory-proto`: the sources do not give a fixed version for the `0.24.0` to `0.26.0-alpha.1` range; unknown.","status":"open","published_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:24:59+00:00","updated_at":"2026-11-08T02:24:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:59Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net`: move to `0.26.2` or later.\n- `hickory-proto`: the sources do not give a fixed version for the `0.24.0` to `0.26.0-alpha.1` range; unknown.","reach":"network","title":"Hickory DNS: DNSSEC key check skips record name, accepting forged keys","impact":"medium","summary":"Hickory DNS resolver libraries compare DNSKEY keys against DNSSEC trust anchors without checking the record name, so a key set made only of trusted keys is accepted without signature verification. An attacker who can spoof or control name server responses can swap a secure zone's DNSKEY set for the root zone's keys and keep it cached with a long TTL.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns-resolver"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"forged DNS keys make a secure zone's records accepted unverified","analyst_note":"Confirm the fixed version for hickory-proto in the 0.24.0 to 0.26.0-alpha.1 range via the GitHub advisory linked from the NVD entry.","how_to_check":"- Check the version of `hickory-net` and `hickory-proto` in your lockfile or `Cargo.lock`.\n- Look for `hickory-net` `0.26.0-beta.1` or later beta builds before `0.26.2`, and `hickory-proto` between `0.24.0` and `0.26.0-alpha.1`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","managed-dns-resolver"],"who_is_affected":"Applications that use the Hickory DNS Rust crates for DNSSEC-validating resolution are exposed, most of all those that accept responses from untrusted or spoofable name servers. Services that do not use these crates for DNS validation can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000791,"input_tokens":4375,"output_tokens":707,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123593':14A,17A '-2026':13A,16A '0.24.0':102C '0.26.0':94C,104C '0.26.2':97C 'abl':135C 'accept':9A,53B,130C 'alpha.1':105C 'anchor':37B,113C 'attack':58B,134C 'beta.1':95C 'cach':84B,165C 'check':5A,39B,115C 'compar':31B,106C 'control':63B,139C 'cve':12A,15A 'dns':2A,19B,24B,28B,90C 'dns-resolv':18B 'dnskey':32B,73B,107C,117C,149C 'dnssec':3A,21B,35B,111C 'forg':10A 'hickori':1A,23B,27B,89C,92C,100C 'hickory-dn':22B 'hickory-net':91C 'hickory-proto':99C 'keep':82B,163C 'key':4A,11A,33B,45B,51B,80B,109C,128C,156C 'larg':160C 'librari':30B 'long':87B 'made':47B,123C 'name':8A,42B,64B,119C,140C 'net':93C 'packag':25B 'proto':101C 'public':108C 'record':7A,41B,118C 'replac':144C 'resolv':20B,29B 'respons':66B,142C 'root':77B,153C 'rrset':122C,150C 'rrsig':132C 'rust':26B 'secur':70B,146C 'server':65B,141C 'set':46B,74B 'signatur':55B 'skip':6A 'spoof':61B,137C 'swap':68B 'trust':36B,50B,112C,127C 'ttl':88B,161C 'use':158C 'verif':56B,133C 'without':38B,54B,114C,131C 'zone':71B,78B,147C,154C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Hickory DNS Rust crates for DNSSEC-validating resolution are exposed, most of all those that accept responses from untrusted or spoofable name servers. Services that do not use these crates for DNS validation can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","medium","package","rust"],"campaign_type":null,"search_a":"'-123593':14A,17A '-2026':13A,16A 'accept':9A 'check':5A 'cve':12A,15A 'dns':2A 'dnssec':3A 'forg':10A 'hickori':1A 'key':4A,11A 'name':8A 'record':7A 'skip':6A","search_b":"'accept':53B 'anchor':37B 'attack':58B 'cach':84B 'check':39B 'compar':31B 'control':63B 'dns':19B,24B,28B 'dns-resolv':18B 'dnskey':32B,73B 'dnssec':21B,35B 'hickori':23B,27B 'hickory-dn':22B 'keep':82B 'key':33B,45B,51B,80B 'librari':30B 'long':87B 'made':47B 'name':42B,64B 'packag':25B 'record':41B 'resolv':20B,29B 'respons':66B 'root':77B 'rust':26B 'secur':70B 'server':65B 'set':46B,74B 'signatur':55B 'spoof':61B 'swap':68B 'trust':36B,50B 'ttl':88B 'verif':56B 'without':38B,54B 'zone':71B,78B","search_c":"'0.24.0':102C '0.26.0':94C,104C '0.26.2':97C 'abl':135C 'accept':130C 'alpha.1':105C 'anchor':113C 'attack':134C 'beta.1':95C 'cach':165C 'check':115C 'compar':106C 'control':139C 'dns':90C 'dnskey':107C,117C,149C 'dnssec':111C 'hickori':89C,92C,100C 'hickory-net':91C 'hickory-proto':99C 'keep':163C 'key':109C,128C,156C 'larg':160C 'made':123C 'name':119C,140C 'net':93C 'proto':101C 'public':108C 'record':118C 'replac':144C 'respons':142C 'root':153C 'rrset':122C,150C 'rrsig':132C 'secur':146C 'server':141C 'spoof':137C 'trust':112C,127C 'ttl':161C 'use':158C 'verif':133C 'without':114C,131C 'zone':147C,154C","first_public_at":"2026-09-03T21:09:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123593","severity":null,"published_at":"2026-11-08T02:16:53+00:00","modified_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99337,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:09:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99338,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-trustanchors","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}