GHSA-5j98-2g5x-46v6
hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
- Risk score
- 50/100
- CVSS
- 7.5 v3.1
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When calling Resolver::lookup() or Resolver::lookup_ip() on a resolver with DNSSEC validation enabled, both methods return Ok(...) if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation d…
- Affected
- hickory-resolver (rust) < 0.26.2
- Fix
- Upgrade hickory-resolver to 0.26.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| hickory-resolver | rust | < 0.26.2 | 0.26.2 |
References
- https://github.com/advisories/GHSA-5j98-2g5x-46v6
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
- https://github.com/hickory-dns/hickory-dns/pull/3871
- https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9
- https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
- https://github.com/advisories/GHSA-5j98-2g5x-46v6
Original description
When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.
Last activity 5 Oct 2026. Patch Forecast updates every hour.