What is GHSA-wgx4-v7mx-crxr?

GHSA-wgx4-v7mx-crxr is a security advisory published by GitHub Security Advisories with High severity. Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1...

Which CVE IDs does GHSA-wgx4-v7mx-crxr cover?

GHSA-wgx4-v7mx-crxr covers the following CVE IDs: CVE-2026-123580. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wgx4-v7mx-crxr?

GHSA-wgx4-v7mx-crxr has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-wgx4-v7mx-crxrHighCVSS 7.5

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123580 →

📋 Description

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.

🔗 References (4)

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4
https://nvd.nist.gov/vuln/detail/CVE-2026-123580
https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-nonexistence-proof-forgery-via-nsec3
https://github.com/advisories/GHSA-wgx4-v7mx-crxr