---
id: "CVE-2026-123593"
page: "https://infrastack.ai/live/CVE-2026-123593"
kind: "vulnerability"
aliases: ["CVE-2026-123593"]
title: "Hickory DNS: DNSSEC key check skips record name, accepting forged keys"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns-resolver", "dnssec", "hickory-dns", "package", "rust"]
not_affected_if: ["managed-dns-resolver", "no-dnssec-validation"]
published_at: "2026-11-08T02:16:53+00:00"
first_seen_at: "2026-11-08T02:21:13+00:00"
updated_at: "2026-11-08T02:24:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123593", "first_seen_at": "2026-11-08T02:21:13+00:00"}]
exploit_sources: []
---

# Hickory DNS: DNSSEC key check skips record name, accepting forged keys

Link for people: https://infrastack.ai/live/CVE-2026-123593 (this .md is for agents)

Hickory DNS resolver libraries compare DNSKEY keys against DNSSEC trust anchors without checking the record name, so a key set made only of trusted keys is accepted without signature verification. An attacker who can spoof or control name server responses can swap a secure zone's DNSKEY set for the root zone's keys and keep it cached with a long TTL.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of `hickory-net` and `hickory-proto` in your lockfile or `Cargo.lock`.
- Look for `hickory-net` `0.26.0-beta.1` or later beta builds before `0.26.2`, and `hickory-proto` between `0.24.0` and `0.26.0-alpha.1`.

## Fix

- `hickory-net`: move to `0.26.2` or later.
- `hickory-proto`: the sources do not give a fixed version for the `0.24.0` to `0.26.0-alpha.1` range; unknown.

## Timeline

- 2026-11-08T02:21:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123593

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-trustanchors

## From the sources

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_