RUSTSEC-2026-0514

Resolver::lookup and lookup_ip returned records that failed DNSSEC validation

Reported

September 3, 2026

Issued

November 12, 2026

Package

hickory-resolver (crates.io)

Type

Vulnerability

Categories

privilege-escalation

Keywords

#dns #dnssec

Aliases

References

https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: High
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Patched

>=0.26.2

Description

With DNSSEC validation enabled, Resolver::lookup() and Resolver::lookup_ip() returned Ok with the records even when validation found the response bogus. The result was only visible in each record's proof status, which callers had to inspect themselves.

Applications that enable validation and treat a successful lookup as validated data would therefore accept forged or tampered answers from anyone who can answer or modify their DNS traffic.

From 0.26.2 a lookup whose records are bogus fails with a "DNSSEC validation failed" error (DnsError::DnssecBogus), the error is not retried, and the hickory-server forwarder answers SERVFAIL for it.

Advisory available under CC0-1.0 license.