CVE-2026-93657 in hickory-resolver
Summary
by MITRE • 09/18/2026
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability in Hickory-Resolver versions prior to 0.26.2 represents a critical failure in the implementation of Domain Name System Security Extensions (DNSSEC) validation logic within the library's core resolution APIs. Specifically, the Resolver::lookup() and Resolver::lookup_ip() methods exhibit an incorrect handling mechanism for bogus DNSSEC proof states. In standard DNSSEC operations, when a resolver encounters cryptographic signatures that are invalid or cannot be validated due to missing keys or broken chains of trust, it must classify this state as bogus. This classification is essential because it signals the application layer that the data source is untrustworthy and should not be used for further processing. However, in these affected versions, the library fails to propagate this bogus status up through the API stack. Instead of rejecting the response or signaling an authentication failure, the resolver proceeds as if the validation was successful, effectively treating forged or tampered records as legitimate and verified data.
This technical flaw creates a significant security gap that undermines the primary purpose of DNSSEC, which is to provide origin authenticity and data integrity for domain name system responses. By failing to enforce strict adherence to bogus proof states, the library allows attackers who control the answering zone or are positioned in a man-in-the-middle capacity on the network path to inject maliciously crafted DNS records. These forged records bypass the cryptographic verification checks that should have rejected them. Consequently, applications relying on Hickory-Resolver for domain resolution may accept these invalid responses as successful lookups. This behavior directly contradicts security best practices outlined in Common Weakness Enumeration (CWE) standards, particularly CWE-295 Improper Certificate Validation and CWE-347 Improper Verification of Cryptographic Signature. The failure to validate cryptographic proofs properly places the integrity of network communications at severe risk.
The operational impact of this vulnerability is substantial for any application utilizing Hickory-Resolver for secure DNS lookups. Attackers can exploit this flaw to redirect users to malicious websites, intercept sensitive data through phishing sites that mimic legitimate domains, or disrupt service availability by returning incorrect IP addresses. Since the validation layer silently accepts these forged records without raising an error flag, downstream applications are left unaware of the compromise in their security posture. This silent failure is particularly dangerous because it prevents automated systems from triggering alerts or fallback mechanisms designed to handle DNSSEC failures. The vulnerability effectively neutralizes the protective benefits of DNSSEC for users of this library version, leaving them vulnerable to domain hijacking and spoofing attacks that rely on the manipulation of DNS responses.
To mitigate this risk, organizations must immediately upgrade Hickory-Resolver to version 0.26.2 or later, where the propagation logic for bogus proof states has been corrected to ensure strict validation compliance. Until an update can be applied, administrators should consider implementing additional network-level controls such as DNS filtering services that enforce DNSSEC validation independently of the application library. Furthermore, developers integrating Hickory-Resolver into their codebases should review any custom error handling routines to ensure they are robust against unexpected success states for invalid queries. Monitoring logs for anomalous resolution patterns or sudden changes in IP addresses associated with trusted domains can also serve as a detection mechanism for potential exploitation attempts. Adherence to these mitigations aligns with industry standards such as MITRE ATT&CK technique T1592 Gather Victim Host Information, which describes how attackers leverage DNS manipulation to map network environments and identify high-value targets for further compromise.