What is CVE-2026-123587?

CVE-2026-123587 is a medium-severity vulnerability in Hickory-Dns, classified under Authentication Bypass by Spoofing. CVSS score: 6.8/10. Published 2026-11-08.

How severe is CVE-2026-123587?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Hickory-Dns

CVE-2026-123587

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.

Published 2026-11-08.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.002 (14.9th percentile), scored 2026-11-09.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 14.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Hickory-Dns

Weakness classification (CWE)

CWE-290 — Authentication Bypass by Spoofing

References

github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5 (vendor-advisory)
www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-dnssec-nonexisten… (third-party-advisory)

Frequently asked questions

What is CVE-2026-123587?: CVE-2026-123587 is a medium-severity vulnerability in Hickory-Dns, classified under Authentication Bypass by Spoofing. CVSS score: 6.8/10. Published 2026-11-08.
How severe is CVE-2026-123587?: Medium severity. CVSS v3 base score is 6.8 out of 10.