Every CVE Search/ Get API key

CVE-2026-93657

hickory-resolver before 0.26.2 DNSSEC Validation Bypass

8.7 HighFix available

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.23%Unchanged since Sep 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

hickory-resolver before 0.26.2 DNSSEC Validation Bypass

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
EUVDEUVD-2026-82939 8.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
EUVD-2026-82939
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5j98-2g5x-46v6 7.5

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup() or Resolver::lookup_ip() on a resolver with DNSSEC validation enabled, both methods return Ok(...) if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.

Record
GHSA-5j98-2g5x-46v6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
GitHub AdvisoriesGHSA-884w-h442-q7ph 8.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the...

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
GHSA-884w-h442-q7ph
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
NVD 8.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
OSV 8.7

hickory-resolver before 0.26.2 DNSSEC Validation Bypass

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-347
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-93657 8.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
DEBIAN-CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-5j98-2g5x-46v6 7.5

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup() or Resolver::lookup_ip() on a resolver with DNSSEC validation enabled, both methods return Ok(...) if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.

Record
GHSA-5j98-2g5x-46v6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
OSVRHSA-2026:85848 7.5

Red Hat Security Advisory: rust-sequoia-sq security update

Record
RHSA-2026:85848
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:85848 7.5

Important: rust-sequoia-sq security update

Command-line frontends for Sequoia.

Security Fix(es):

  • hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)

  • rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:85848
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-93657 8.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
UBUNTU-CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:85848 No score

Important: rust-sequoia-sq security update

Command-line frontends for Sequoia.

Security Fix(es):

  • hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)
  • rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:85848
Updated
2026-11-02
OSVopenSUSE-SU-2026:11923-1 No score

openai-codex-0.158.0-1.1 on GA media

These are all security issues fixed in the openai-codex-0.158.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11923-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
hickory-resolver
crates.io
 before 0.26.2
0.26.2
sequoia-sq
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1.4.0.1-4.el10_2
1.4.0.1-4.el10_2
rust-hickory-resolver
Debian:13
 All versions, plus listed versions
0.24.4-10.24.4-20.24.4-30.24.4-40.24.4-5
Show 4 moreShow less
0.25.2-10.25.2-20.26.1-10.26.3-1
 None known
rust-hickory-resolver
Debian:14
 before 0.26.3-1, plus listed versions
0.24.4-10.24.4-20.24.4-30.24.4-40.24.4-50.25.2-10.25.2-20.26.1-1
0.26.3-1
rust-sequoia-sq
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
rust-sequoia-sq-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
sequoia-sq
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
sequoia-sq-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
rust-sequoia-sq
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
rust-hickory-resolver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.24.0-1
 None known
rust-hickory-resolver
Ubuntu:26.10
 All versions, plus listed versions
0.24.4-50.26.1-1
 None known
rust-hickory-resolver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.24.4-10.24.4-5
 None known
openai-codex
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 0.158.0-1.1
0.158.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93657 is a high vulnerability (CVSS 8.7) in Hickory-dns Hickory-resolver, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in hickory-resolver 0.26.2.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open