Dashboard / CVE-2026-123593

CVE-2026-123593

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 73/100
Published: 2026-11-08 Modified: 2026-11-10 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: Present
VC: None
VI: Low
VA: Low

Description

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
hickory-dns hickory-dns 0.26.0-beta.1 < 0.26.2
hickory-dns hickory-dns 0.24.0
hickory-dns hickory-dns 0.26.0-beta.1 < 0.26.2
hickory-dns hickory-dns 0.24.0

References & Advisories (2)

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.25%
Raw Score 0.002480
Percentile 16.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00248
2026-11-12
0.00248
2026-11-10
0.00248
2026-11-09
0.00248
2026-11-08
0.00248

Intelligence Sources

mitre ref →
nvd ref →

External Links