What is GHSA-g99j-j499-7pp4?

GHSA-g99j-j499-7pp4 is a security advisory published by GitHub Security Advisories with Medium severity. hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0...

Which CVE IDs does GHSA-g99j-j499-7pp4 cover?

GHSA-g99j-j499-7pp4 covers the following CVE IDs: CVE-2026-123603. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g99j-j499-7pp4?

GHSA-g99j-j499-7pp4 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-g99j-j499-7pp4MediumCVSS 6.5

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123603 →

📋 Description

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.

🔗 References (4)

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4jwp-xjwm-333g
https://nvd.nist.gov/vuln/detail/CVE-2026-123603
https://www.vulncheck.com/advisories/hickory-dns-missing-ipv4-mapped-ipv6-canonicalization-access-control-bypass
https://github.com/advisories/GHSA-g99j-j499-7pp4