# CVE-2026-123593: Hickory DNS DNSSEC validation bypass in TrustAnchors

Source: https://junglewise.ai/threats/cve-2026-123593-hickory-dns-hickory-net-0-26-0-beta-1-before-0-26-2-and-hickory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123593 · Severity: medium · CVSS 4.8 · Published 2026-11-08

Hickory DNS is a DNS resolution library used to validate domain authenticity through DNSSEC. A flaw in the validation logic allows attackers who can intercept or control DNS responses to replace a legitimate zone's cryptographic keys with the root zone's keys, bypassing security checks. The attacker's modifications can persist in the DNS cache due to artificially long expiration times, potentially allowing DNS spoofing attacks on cached queries.

Technologies: [Hickory-Dns Hickory-Net](https://junglewise.ai/threats/technologies/hickory-dns-hickory-net), [Hickory-Dns Hickory-Proto](https://junglewise.ai/threats/technologies/hickory-dns-hickory-proto). Vendors: [Hickory-Dns](https://junglewise.ai/threats/vendors/hickory-dns).

## Quick answers

**Is CVE-2026-123593 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123593 being exploited in the wild.

**How severe is CVE-2026-123593?** Medium severity, with a CVSS score of 4.8, published 8 November 2026.

**Which products and versions are affected?** Hickory-Dns Hickory-Net 0.26.0-beta.1 before 0.26.2; Hickory-Dns Hickory-Proto 0.24.0 through 0.26.0-alpha.1.

**Is there a fix for CVE-2026-123593?** Yes: fixed in hickory-net 0.26.2; hickory-proto no fix stated. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123593 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123593?** Check whether you run Hickory-Dns Hickory-Net or Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in hickory-net 0.26.2; hickory-proto no fix stated

## Technical details

The TrustAnchors component fails to verify the record name when comparing DNSKEY public keys during DNSSEC validation, only checking the key value itself. An attacker with network control over DNS responses can substitute any zone's DNSKEY RRset with root zone keys; if all keys in the RRset are trusted, verification succeeds without RRSIG signature checking. The vulnerability requires the attacker to spoof or control name server responses, but the temporal impact can be extended through cached responses with inflated TTLs.

## Affected products

- Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2
- Hickory DNS hickory-proto 0.24.0 through 0.26.0-alpha.1

## Timeline

- 2026-09-03: disclosed: GitHub Security Advisory GHSA-j2rc-wxwh-62g9 published
- 2026-11-08: advisory: CVE-2026-123593 published

## References

- [https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9)
- [https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-trustanchors](https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-trustanchors)

## Related threats

- [Hickory DNS hickory-proto denial of service in BinEncoder](https://junglewise.ai/threats/cve-2026-123608-hickory-dns-hickory-proto-from-0-3-1-before-0-26-1-contains-a)
- [Hickory DNS NSEC3 closest-encloser proof unbounded loop](https://junglewise.ai/threats/cve-2026-123607-hickory-dns-hickory-proto-0-25-0-alpha-3-through-0-25-2-and)
- [Hickory DNS DNSSEC validation bypass via RRSIG Signer's Name](https://junglewise.ai/threats/cve-2026-123605-hickory-dns-hickory-proto-0-1-through-0-25-0-alpha-3-and-hickory)
- [Hickory DNS IPv4-mapped IPv6 canonicalization bypass](https://junglewise.ai/threats/cve-2026-123603-hickory-proto-and-hickory-resolver-0-26-0-before-0-26-2-hickory)
- [Hickory DNS NSEC3 comparison operator inversion](https://junglewise.ai/threats/cve-2026-123601-hickory-dns-hickory-proto-0-25-0-through-0-26-0-alpha-1-and)