CVE-2026-93657

High

Description

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

SeverityHigh

CVSS7.5

Exploit probability—

ProductHickory-dns Hickory-resolver

PublishedSep 18, 2026

First seenSep 18, 2026

Weakness typeCWE-347CWE-347

How to fix

Update

hickory-dns hickory-resolver0.26.2 or later

Patches

github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238
github.com/hickory-dns/hickory-dns/pull/3871

Vendor advisories

github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2

Affected products

Product	Affected versions	Fixed in
hickory-dns hickory-resolver	v < 0.26.2	0.26.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.