hickory-resolver before 0.26.2 DNSSEC Validation Bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-93657 · CVE overview and exploitation status

EUVD-2026-82939

GHSA-884w-h442-q7ph

GHSA-5j98-2g5x-46v6

RUSTSEC-2026-0514

cve-program · CVE-2026-93657

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
• https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238
• https://github.com/hickory-dns/hickory-dns/pull/3871
• https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
• https://github.com/hickory-dns/hickory-dns
• https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass

euvd · EUVD-2026-82939

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
• https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238
• https://github.com/hickory-dns/hickory-dns/pull/3871
• https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
• https://github.com/hickory-dns/hickory-dns
• https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass

nvd · CVE-2026-93657

• https://github.com/hickory-dns/hickory-dns
• https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238
• https://github.com/hickory-dns/hickory-dns/pull/3871
• https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
• https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass

osv · GHSA-5j98-2g5x-46v6

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
• https://github.com/hickory-dns/hickory-dns/pull/3871
• https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9
• https://github.com/hickory-dns/hickory-dns
• https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2

osv · RUSTSEC-2026-0514

• https://crates.io/crates/hickory-resolver
• https://rustsec.org/advisories/RUSTSEC-2026-0514.html
• https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238

• `Resolver::lookup` and `lookup_ip` returned records that failed DNSSEC validation · Newly collected advisory · 12 Nov 2026
• hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures · Advisory content revised · 12 Nov 2026