hickory-resolver lookup() and lookup_ip() obscure DNSSEC validation failures
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-347.
Summary
hickory-resolver before 0.26.2 returns Ok from its Resolver::lookup() and Resolver::lookup_ip() methods even when DNSSEC validation fails on a resolver with validation enabled. Callers must inspect each record's validation status themselves to find bogus answers, which the APIs do not surface as errors. This is classified as CWE-347, improper verification of cryptographic signatures.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the GitHub advisory
When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | hickory-resolver (crates.io) | before 0.26.2 | 0.26.2 | Patch available | GHSA-5j98-2g5x-46v6 |
- hickory-resolver (crates.io) Vendor— Affected before 0.26.2 Fixed in 0.26.2 Patch available GHSA-5j98-2g5x-46v6
Remediation
Upgrade hickory-resolver to version 0.26.2 on crates.io, which returns an error when DNSSEC validation determines a response is bogus.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · GHSA-5j98-2g5x-46v6 hickory-resolver (crates.io) Fixed in 0.26.2 Advisory →
Timeline
- 2026-10-06 Threatist record created from GHSA-5j98-2g5x-46v6
References
Other 5
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
- https://github.com/hickory-dns/hickory-dns/pull/3871
- https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9
- https://github.com/hickory-dns/hickory-dns
- https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences