What is GHSA-h7hc-rhv6-hvw6?

GHSA-h7hc-rhv6-hvw6 is a security advisory published by GitHub Security Advisories with High severity. Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a...

Which CVE IDs does GHSA-h7hc-rhv6-hvw6 cover?

GHSA-h7hc-rhv6-hvw6 covers the following CVE IDs: CVE-2026-123605. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h7hc-rhv6-hvw6?

GHSA-h7hc-rhv6-hvw6 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-h7hc-rhv6-hvw6HighCVSS 8.8

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123605 →

📋 Description

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.

🔗 References (4)

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c
https://nvd.nist.gov/vuln/detail/CVE-2026-123605
https://www.vulncheck.com/advisories/hickory-dns-through-0.25.0-alpha.3-dnssec-validation-bypass-via-rrsig-signer-s-name
https://github.com/advisories/GHSA-h7hc-rhv6-hvw6