{"id":"CVE-2026-93657","aliases":["ALSA-2026:85848","DEBIAN-CVE-2026-93657","EUVD-2026-82939","GHSA-5j98-2g5x-46v6","GHSA-884w-h442-q7ph","RHSA-2026:85848","RLSA-2026:85848","UBUNTU-CVE-2026-93657","openSUSE-SU-2026:11923-1"],"status":"published","title":"hickory-resolver before 0.26.2 DNSSEC Validation Bypass","description":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00231,"percentile":0.14052,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-09-18T14:23:20Z","modified":"2026-10-29T11:31:00Z","fixes":[{"ecosystem":"crates.io","package":"hickory-resolver","fixed_in":["0.26.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-hickory-resolver","fixed_in":["0.26.3-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.1-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-5","0.25.2-1","0.25.2-2","0.26.1-1","0.26.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.3-1"}]}],"versions":["0.24.4-1","0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-5","0.25.2-1","0.25.2-2","0.26.1-1"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-resolver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rust-sequoia-sq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sequoia-sq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rust-sequoia-sq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0.1-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-5","0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.24.4-5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openai-codex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.158.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"hickory-dns","product":"hickory-resolver"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6","tags":["vendor-advisory","advisory","web","article","report"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238","tags":["patch","fix","article","report"]},{"url":"https://github.com/hickory-dns/hickory-dns/pull/3871","tags":["patch","issue-tracking","fix","web","article","report"]},{"url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2","tags":["release-notes","advisory","web","article","report"]},{"url":"https://github.com/hickory-dns/hickory-dns","tags":["product","package","article","report"]},{"url":"https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass","tags":["third-party-advisory","advisory","article","report"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5j98-2g5x-46v6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93657","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-884w-h442-q7ph"},{"url":"https://access.redhat.com/errata/RHSA-2026:85848","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93599","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93657","tags":["report"]},{"url":"https://bugzilla.redhat.com/2538208","tags":["report"]},{"url":"https://bugzilla.redhat.com/2538431","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-85848.html","tags":["advisory"]},{"url":"https://crates.io","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93657.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93657","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538431","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85848.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93599","tags":["advisory"]},{"url":"https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93657","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85848","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-93657","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93657","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-93657","title":"hickory-resolver before 0.26.2 DNSSEC Validation Bypass","description":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.","status":"published","published":"2026-09-18T14:23:20.181Z","modified":"2026-09-21T20:51:40.507Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-82939","description":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.","status":"published","published":"2026-09-18T14:23:20Z","modified":"2026-09-21T20:51:40Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:03.79222Z"}],"ghsa":[{"id":"GHSA-5j98-2g5x-46v6","title":"hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures","description":"When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.","status":"published","published":"2026-10-05T22:54:35Z","modified":"2026-10-05T22:54:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:41:27.036917Z"},{"id":"GHSA-884w-h442-q7ph","title":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the...","description":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.","status":"published","published":"2026-09-18T15:32:20Z","modified":"2026-09-18T15:32:31Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:12:10.152672Z"}],"nvd":[{"id":"CVE-2026-93657","description":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.","status":"published","published":"2026-09-18T15:17:22.19Z","modified":"2026-09-22T20:53:07.383Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"CVE-2026-93657","title":"hickory-resolver before 0.26.2 DNSSEC Validation Bypass","description":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.","status":"published","published":"2026-09-18T14:23:20.181Z","modified":"2026-10-28T02:31:09.263674582Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"DEBIAN-CVE-2026-93657","description":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.","status":"published","published":"2026-09-18T15:17:22.19Z","modified":"2026-09-23T08:47:28.900006822Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"GHSA-5j98-2g5x-46v6","title":"hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures","description":"When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.","status":"published","published":"2026-10-05T22:54:35Z","modified":"2026-10-05T23:00:04.250222435Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"RHSA-2026:85848","title":"Red Hat Security Advisory: rust-sequoia-sq security update","status":"published","published":"2026-10-20T10:18:16Z","modified":"2026-10-20T10:30:27.955336507Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:85848","title":"Important: rust-sequoia-sq security update","description":"Command-line frontends for Sequoia.\n\nSecurity Fix(es):\n\n* hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)\n\n* rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-21T12:08:03.04509Z","modified":"2026-10-21T12:30:02.594870316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-93657","description":"hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.","status":"published","published":"2026-09-18T15:17:00Z","modified":"2026-10-17T13:01:18.424952503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"ALSA-2026:85848","title":"Important: rust-sequoia-sq security update","description":"Command-line frontends for Sequoia.  \n\nSecurity Fix(es):  \n\n  * hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)\n  * rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:31:00.996766069Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"openSUSE-SU-2026:11923-1","title":"openai-codex-0.158.0-1.1 on GA media","description":"These are all security issues fixed in the openai-codex-0.158.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-09-30T18:23:14.338457016Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}