What’s Vulnerable › Vulnerabilities

CVE-2026-93657: hickory-resolver before 0.26.2 DNSSEC Validation Bypass

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-09-22
• Weakness: CWE-347

Description

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Affected products

• Crates.Io Hickory-Resolver: before 0.26.2 — fixed in 0.26.2
• hickory-dns hickory-resolver: before 0.26.2 — fixed in 0.26.2

How to fix

Upgrade to a fixed version: Crates.Io Hickory-Resolver 0.26.2; hickory-dns hickory-resolver 0.26.2. Check the vendor advisory for mitigations.

References

• https://github.com/hickory-dns/hickory-dns
• https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238
• https://github.com/hickory-dns/hickory-dns/pull/3871
• https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
• https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass

Get alerted when CVE-2026-93657 or the next vulnerability affects your stack