What is GHSA-fh93-8wxc-33gf?

GHSA-fh93-8wxc-33gf is a security advisory published by GitHub Security Advisories with Medium severity. Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha...

Which CVE IDs does GHSA-fh93-8wxc-33gf cover?

GHSA-fh93-8wxc-33gf covers the following CVE IDs: CVE-2026-123593. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fh93-8wxc-33gf?

GHSA-fh93-8wxc-33gf has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-fh93-8wxc-33gfMediumCVSS 4.8

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123593 →

📋 Description

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

🔗 References (4)

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9
https://nvd.nist.gov/vuln/detail/CVE-2026-123593
https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-trustanchors
https://github.com/advisories/GHSA-fh93-8wxc-33gf