CVE-2026-93657: hickory-resolver DNSSEC Validation Failure

Background

hickory-resolver is a Rust library designed for DNS resolution, providing APIs for looking up domain names and IP addresses. It supports DNSSEC validation to ensure the authenticity of DNS responses. However, a flaw in its implementation allows certain validation failures to go unnoticed, potentially leading to security risks.

Vulnerability Detail

The vulnerability arises from the behavior of the Resolver::lookup() and Resolver::lookup_ip() APIs when DNSSEC validation is enabled. Instead of returning an error when validation fails, these methods return Ok(...), obscuring the failure. This can mislead developers into believing that a DNS response is valid when it is not, exposing applications to potential attacks that exploit bogus DNS responses.

Workaround

As a temporary workaround, developers can manually check the validation status of individual DNS records after calling the lookup methods. This can be cumbersome but ensures that bogus responses are identified. Example code snippet:

let result = resolver.lookup("example.com");
if let Ok(records) = result {
    for record in records {
        if !record.is_valid() {
            // Handle invalid record
        }
    }
}

Conclusion

The hickory-resolver package has a critical vulnerability related to DNSSEC validation that can lead to accepting invalid DNS responses. It is crucial to update to the patched version 0.26.2 to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.

See every vulnerability recorded for hickory-resolver →

FAQ