hickory-resolver before 0.26.2 DNSSEC Validation Bypass
Priority MEDIUM 43CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 4 fixed, 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-347.
Summary
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00231 13th percentileScored 2026-11-07
Fix Partial hickory-resolver (hickory-dns): 0.26.2Red Hat: 4 advisoriesRed Hat: 4 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hickory-dns | hickory-resolver | before 0.26.2 | 0.26.2 | Patch available | CNA |
- hickory-resolver Vendorhickory-dns Affected before 0.26.2 Fixed in 0.26.2 Patch available CNA
Remediation
- Fix · CNA hickory-resolver (hickory-dns) Fixed in 0.26.2
Red Hat 4 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:86891 Released 2026-10-21 · Red Hat rating CriticalRHOAI 3.5.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
- RHSA-2026:85848 Released 2026-10-20 · Red Hat rating Importantrust-sequoia-sq security update
- Red Hat Enterprise Linux AppStream (v. 10) rust-sequoia-sq-1.4.0.1-4.el10_2, sequoia-sq-1.4.0.1-4.el10_2
Show 1 more Red Hat advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:85848 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift AI 3.5 | Fixed | RHSA-2026:86891 |
Not affected: 7 products
- Logging Subsystem for Red Hat OpenShift
- OpenShift Service Mesh 3
- Red Hat Hardened Images
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI 3.5
- Red Hat OpenShift Update Service
Timeline
- 2026-10-02 Threatist record created from CVE-2026-93657
- 2026-10-03 Alias added: GHSA-884w-h442-q7ph
- 2026-10-20 Fix available: RHSA-2026:85848 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
References
More hickory-dns vulnerabilities
- TI-2025-18857 DNSSEC validation may accept broken authentication chains CVSS 4.0MEDIUM 5.7
- TI-2026-86729 DNSSEC nonexistence forgery in Hickory DNS via wraparound NSEC CVSS 4.0HIGH 8.9
- TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression CVSS 4.0HIGH 8.7
- TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of service CVSS 4.0HIGH 8.7
- TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
- TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer name CVSS 4.0HIGH 8.7
Sources
- CVE-2026-93657 · CVE Program
- CVE-2026-93657 · NVD
- FIRST EPSS
- GHSA-884w-h442-q7ph · GitHub Advisory Database · CC BY 4.0
- CVE-2026-93657 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences