{"id":"RUSTSEC-2026-0514","summary":"`Resolver::lookup` and `lookup_ip` returned records that failed DNSSEC validation","details":"With DNSSEC validation enabled, `Resolver::lookup()` and `Resolver::lookup_ip()` returned `Ok` with the records even when validation found the response bogus. The result was only visible in each record's proof status, which callers had to inspect themselves.\n\nApplications that enable validation and treat a successful lookup as validated data would therefore accept forged or tampered answers from anyone who can answer or modify their DNS traffic.\n\nFrom 0.26.2 a lookup whose records are bogus fails with a \"DNSSEC validation failed\" error (`DnsError::DnssecBogus`), the error is not retried, and the hickory-server forwarder answers SERVFAIL for it.","aliases":["CVE-2026-93657","GHSA-5j98-2g5x-46v6"],"modified":"2026-11-12T14:30:06.143103321Z","published":"2026-09-03T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-resolver"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0514.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238"}],"affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affects":{"functions":[],"arch":[],"os":[]},"affected_functions":null},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0514.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}