What is CVE-2026-123587?

CVE-2026-123587 is a medium-severity vulnerability in Hickory-Dns, classified under Authentication Bypass by Spoofing. CVSS score: 6.8/10. Published 2026-11-08.

How severe is CVE-2026-123587?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Hickory-Dns

CVE-2026-123587

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.

Published 2026-11-08.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Hickory-Dns

Weakness classification (CWE)

CWE-290 — Authentication Bypass by Spoofing

References

GitHub Security Advisory (GHSA-qw83-5pm2-ggp5) (vendor-advisory)
VulnCheck Advisory: Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC (third-party-advisory)

Frequently asked questions

What is CVE-2026-123587?: CVE-2026-123587 is a medium-severity vulnerability in Hickory-Dns, classified under Authentication Bypass by Spoofing. CVSS score: 6.8/10. Published 2026-11-08.
How severe is CVE-2026-123587?: Medium severity. CVSS v3 base score is 6.8 out of 10.