---
id: CVE-2026-123593
title: >-
  Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via
  TrustAnchors
summary: >-
  Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0
  through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors
  without checking the DNSKEY record name, so an RRset made up only of trusted
  keys…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-1023
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns >= 0.26.0-beta.1 < 0.26.2
  - hickory-dns >= 0.24.0 <= 0.26.0-alpha.1
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:23.719Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123593'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9
    label: GitHub Security Advisory (GHSA-j2rc-wxwh-62g9)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-trustanchors
    label: >-
      VulnCheck Advisory: Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC
      Validation Bypass via TrustAnchors
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.647Z'
---

## Overview

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

## Affected

- `hickory-dns >= 0.26.0-beta.1 < 0.26.2`
- `hickory-dns >= 0.24.0 <= 0.26.0-alpha.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.