What is GHSA-f6qc-6m8j-6hgc?

GHSA-f6qc-6m8j-6hgc is a security advisory published by GitHub Security Advisories with Medium severity. Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1...

Which CVE IDs does GHSA-f6qc-6m8j-6hgc cover?

GHSA-f6qc-6m8j-6hgc covers the following CVE IDs: CVE-2026-123590. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f6qc-6m8j-6hgc?

GHSA-f6qc-6m8j-6hgc has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-f6qc-6m8j-6hgcMediumCVSS 4.8

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123590 →

📋 Description

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

🔗 References (4)

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6
https://nvd.nist.gov/vuln/detail/CVE-2026-123590
https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-improper-nsec-nsec3-signature-validation
https://github.com/advisories/GHSA-f6qc-6m8j-6hgc