Description
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hickory-dns | hickory-resolver | < 0.26.2 | 0.26.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-hickory-resolver | 0.26.3-1 | — |
| Debian 13 | rust-hickory-resolver | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-hickory-resolver | No fix yet | — |
| Ubuntu 26.04 LTS | rust-hickory-resolver | No fix yet | — |
| Ubuntu 24.04 LTS | rust-hickory-resolver | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | sequoia-sq +1 | 1.4.0.1-4.el10_2 | RHSA-2026:85848 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | sequoia-sq | 1.4.0.1-4.el10_2 | ALSA-2026:85848 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | rust-sequoia-sq | 1.4.0.1-4.el10_2 | RLSA-2026:85848 |
| Rocky Linux 10 | sequoia-sq | 1.4.0.2-3.el10_3 | RLSA-2026:98075 |
| Rocky Linux 9 | sequoia-sq | 1.4.0.2-4.el9_9 | RLSA-2026:97868 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openai-codex | 0.158.0-1.1 | openSUSE-SU-2026:11923-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | sequoia-sq | 1.4.0.1-4.0.1.el10_2 | ELSA-2026-85848 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | hickory-resolver | < 0.26.2 | 0.26.2 | GHSA-5j98-2g5x-46v6 |
| crates.io | hickory-resolver | >= 0.0.0-0, < 0.26.2 | 0.26.2 | RUSTSEC-2026-0514 |
Advisories 8
- RLSA-2026:98075 Important: rust-sequoia-sq security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97868 Important: rust-sequoia-sq security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4472 Red Hat Enterprise Linux (python-jwcrypto, sos, hickory-resolver, libimobiledevice, gcc, python-oauthlib): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:85848 Important: rust-sequoia-sq security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:85848 Important: rust-sequoia-sq security update Rocky Linux Security Advisories · Oct 21, 2026
- RHSA-2026:85848 Red Hat Security Advisory: rust-sequoia-sq security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-85848 Important: rust-sequoia-sq security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- openSUSE-SU-2026:11923-1 openai-codex-0.158.0-1.1 on GA media SUSE / openSUSE Security Updates · Sep 30, 2026
References
- GitHub Security Advisory (GHSA-5j98-2g5x-46v6) vendor-advisory
- Return error from Resolver::lookup() if bogus patch
- Pull Request #3871 patch issue-tracking
- hickory-resolver v0.26.2 Release Notes release-notes
- https://github.com/hickory-dns/hickory-dns product
- VulnCheck Advisory: hickory-resolver before 0.26.2 DNSSEC Validation Bypass third-party-advisory