GitHub Advisoryadvisory · crates.io
GHSA-5j98-2g5x-46v6 hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
HIGH
Official page ↗
- Ecosystem
- crates.io
- Packages
- hickory-resolver
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-347
- Reviewed
- 2026-10-05
Affected packages
• crates.io hickory-resolver: < 0.26.2 → fixed in 0.26.2
Description
When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.
Related
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness
References
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6 web
- https://github.com/hickory-dns/hickory-dns/pull/3871 web
- https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9 web
- https://github.com/hickory-dns/hickory-dns package
- https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2 web