Every CVESearch/Get API key

CVE-2026-93657

hickory-resolver before 0.26.2 DNSSEC Validation Bypass

8.7 HighFix available

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.23%Unchanged since Sep 19, 2026
90%50%10%1%

What each source reports

CVE List Score used8.7

hickory-resolver before 0.26.2 DNSSEC Validation Bypass

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
EUVDEUVD-2026-829398.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
EUVD-2026-82939
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5j98-2g5x-46v67.5

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup() or Resolver::lookup_ip() on a resolver with DNSSEC validation enabled, both methods return Ok(...) if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.

Record
GHSA-5j98-2g5x-46v6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
GitHub AdvisoriesGHSA-884w-h442-q7ph8.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the...

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
GHSA-884w-h442-q7ph
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
NVD8.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
OSV8.7

hickory-resolver before 0.26.2 DNSSEC Validation Bypass

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-347
Updated
2026-11-12
Show 10 moreShow less
OSVDEBIAN-CVE-2026-936578.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
DEBIAN-CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-5j98-2g5x-46v67.5

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup() or Resolver::lookup_ip() on a resolver with DNSSEC validation enabled, both methods return Ok(...) if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.

Record
GHSA-5j98-2g5x-46v6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-12
OSVRHSA-2026:858487.5

Red Hat Security Advisory: rust-sequoia-sq security update

Record
RHSA-2026:85848
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:858487.5

Important: rust-sequoia-sq security update

Command-line frontends for Sequoia.

Security Fix(es):

  • hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)

  • rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:85848
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:978687.5

Important: rust-sequoia-sq security update

Command-line frontends for Sequoia.

Security Fix(es):

  • hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:97868
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-13
OSVRLSA-2026:980757.5

Important: rust-sequoia-sq security update

Command-line frontends for Sequoia.

Security Fix(es):

  • hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:98075
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-13
OSVRUSTSEC-2026-05147.5

`Resolver::lookup` and `lookup_ip` returned records that failed DNSSEC validation

With DNSSEC validation enabled, Resolver::lookup() and Resolver::lookup_ip() returned Ok with the records even when validation found the response bogus. The result was only visible in each record's proof status, which callers had to inspect themselves.

Applications that enable validation and treat a successful lookup as validated data would therefore accept forged or tampered answers from anyone who can answer or modify their DNS traffic.

From 0.26.2 a lookup whose records are bogus fails with a "DNSSEC validation failed" error (DnsError::DnssecBogus), the error is not retried, and the hickory-server forwarder answers SERVFAIL for it.

Record
RUSTSEC-2026-0514
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-12
OSVUBUNTU-CVE-2026-936578.7

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Record
UBUNTU-CVE-2026-93657
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:85848No score

Important: rust-sequoia-sq security update

Command-line frontends for Sequoia.

Security Fix(es):

  • hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)
  • rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:85848
Updated
2026-11-02
OSVopenSUSE-SU-2026:11923-1No score

openai-codex-0.158.0-1.1 on GA media

These are all security issues fixed in the openai-codex-0.158.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11923-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
hickory-resolver
crates.io
before 0.26.2
0.26.2
sequoia-sq
AlmaLinux:10
From an advisory covering 2 CVEs
before 1.4.0.1-4.el10_2
1.4.0.1-4.el10_2
rust-hickory-resolver
Debian:13
All versions, plus listed versions
0.24.4-10.24.4-20.24.4-30.24.4-40.24.4-5
Show 4 moreShow less
0.25.2-10.25.2-20.26.1-10.26.3-1
None known
rust-hickory-resolver
Debian:14
before 0.26.3-1, plus listed versions
0.24.4-10.24.4-20.24.4-30.24.4-40.24.4-50.25.2-10.25.2-20.26.1-1
0.26.3-1
rust-sequoia-sq
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
rust-sequoia-sq-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
sequoia-sq
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
sequoia-sq-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
rust-sequoia-sq
Rocky Linux:10
From an advisory covering 2 CVEs
before 0:1.4.0.1-4.el10_2
0:1.4.0.1-4.el10_2
rust-sequoia-sq-debugsource
Rocky Linux:9
before 0:1.4.0.2-4.el9_9
0:1.4.0.2-4.el9_9
Show 10 moreShow less
Affected packages
PackageAffectedFixed
sequoia-sq
Rocky Linux:9
before 0:1.4.0.2-4.el9_9
0:1.4.0.2-4.el9_9
sequoia-sq-debuginfo
Rocky Linux:9
before 0:1.4.0.2-4.el9_9
0:1.4.0.2-4.el9_9
sequoia-sq
Rocky Linux:10
before 0:1.4.0.2-3.el10_3
0:1.4.0.2-3.el10_3
sequoia-sq-debuginfo
Rocky Linux:10
before 0:1.4.0.2-3.el10_3
0:1.4.0.2-3.el10_3
rust-sequoia-sq-debugsource
Rocky Linux:10
before 0:1.4.0.2-3.el10_3
0:1.4.0.2-3.el10_3
hickory-resolver
crates.io
0.0.0-0 up to 0.26.2
0.26.2
rust-hickory-resolver
Ubuntu:24.04:LTS
All versions, plus listed versions
0.24.0-1
None known
rust-hickory-resolver
Ubuntu:26.10
All versions, plus listed versions
0.24.4-50.26.1-1
None known
rust-hickory-resolver
Ubuntu:26.04:LTS
All versions, plus listed versions
0.24.4-10.24.4-5
None known
openai-codex
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 0.158.0-1.1
0.158.0-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, published, referencesOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93657 is a high vulnerability (CVSS 8.7) in Hickory-dns Hickory-resolver, published September 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in hickory-resolver 0.26.2.

References

Show 32 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open