What is GHSA-p25q-gxfm-cmhr?

GHSA-p25q-gxfm-cmhr is a security advisory published by GitHub Security Advisories with Medium severity. The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory...

Which CVE IDs does GHSA-p25q-gxfm-cmhr cover?

GHSA-p25q-gxfm-cmhr covers the following CVE IDs: CVE-2026-123598. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p25q-gxfm-cmhr?

GHSA-p25q-gxfm-cmhr has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-p25q-gxfm-cmhrMediumCVSS 3.7

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123598 →

📋 Description

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.

🔗 References (4)

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-29q9-p769-j8gq
https://nvd.nist.gov/vuln/detail/CVE-2026-123598
https://www.vulncheck.com/advisories/hickory-dns-0.25.0-through-0.26.0-alpha.1-dnssec-bogus-answer-cache-poisoning
https://github.com/advisories/GHSA-p25q-gxfm-cmhr