Bug 2542980

Summary: CVE-2026-93657 rust-hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Ganesh <gnaik>
Component: rust-hickory-resolverAssignee: Rust SIG <rust-sig>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: epel10CC: decathorpe, rust-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["6a2d8040-7455-49ab-8227-c63a4e3d74bf"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-29 14:59:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2538208    

Description Ganesh 2026-09-29 06:59:58 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
Comment 1 Fabio Valentini 2026-09-29 14:59:46 UTC 
rust-hickory-resolver (the non-suffixed non-compat package) has been at version 0.26.3 for a while, and the only application that currently pulls in hickory-resolver (rust-siguldry-fedora-autopen) has been built with v0.26.3.

Only the rust-hickory-resolver0.24 and rust-hickory-resolver0.25 package consumers are affected, and resolving this is not straightforward since it requires porting the applications / libraries to v0.26, which contains many breaking API changes.