CVE-2026-93657
hickory-resolver before 0.26.2 DNSSEC Validation Bypass
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 18, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 18, 2026
Description
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
hickory-resolverhickory-dns |
|
References
- GitHub Security Advisory (GHSA-5j98-2g5x-46v6)vendor-advisory
- Return error from Resolver::lookup() if boguspatch
- Pull Request #3871patchissue-tracking
- hickory-resolver v0.26.2 Release Notesrelease-notes
- https://github.com/hickory-dns/hickory-dnsproduct
- VulnCheck Advisory: hickory-resolver before 0.26.2 DNSSEC Validation Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.