CVE-2026-123599

medium

Description

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

References

https://www.vulncheck.com/advisories/hickory-dns-before-0.26.0-beta.1-dnssec-validation-bypass-via-non-in-class-records

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wjgj-fvg9-65w9

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119358

Details

Source: Mitre, NVD

Published: 2026-11-08

Updated: 2026-11-08

Risk Information

CVSS v2

Base Score: 2.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

Severity: Low

CVSS v3

Base Score: 3.7

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Severity: Low

CVSS v4

Base Score: 6.3

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.0012