hickory-resolver CVE-2026-93657

Exploitation requires that the consuming application enables DNSSEC validation (the crate's __dnssec feature) and treats validated lookups as a trust boundary, AND that the attacker either controls the authoritative zone answering the query or holds an on-path/MITM position to inject forged records with invalid RRSIGs. The bypass only manifests through the high-level Resolver::lookup() and Resolver::lookup_ip() APIs. Limiting factors: applications that do not enable DNSSEC gain no protection to bypass and are unaffected; the attacker must be able to influence answers (zone control or network position), so it is not exploitable by an arbitrary remote host with no path to the traffic; and it affects only hickory-resolver versions before 0.26.2.

This is a genuine, high-priority integrity flaw despite the absence of exploitation telemetry. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VI:H, all other impacts N) correctly models a network-reachable, unauthenticated, integrity-only DNSSEC validation bypass - a security control silently failing open. hickory-resolver before 0.26.2 accepts records whose DNSSEC proof state is Bogus as successful validated results because the bogus state is never propagated out through the Resolver::lookup()/lookup_ip() public APIs; the fix (PR #3871) adds a DnssecSummary::Bogus check in caching_client that returns a new DnssecBogus error. No EPSS score, no CISA KEV entry, and no public POC were provided in the input, so there is no public exploit identified at time of analysis. The signals are consistent rather than conflicting: high impact but no evidence of mass exploitation, which fits a targeted MITM/zone-control attack rather than opportunistic scanning. The realistic caveat is that impact is entirely conditional on the consuming application actually enabling DNSSEC validation and relying on it as a security boundary - a resolver that never turned DNSSEC on gets no benefit and therefore suffers no regression from this bug.

An attacker who controls the answering authoritative zone, or who is positioned on the network path (on-path/MITM) between the resolver and upstream, returns forged DNS records with invalid or corrupted RRSIG signatures. A downstream service using hickory-resolver's lookup_ip() with DNSSEC enabled receives these forged records as a successful, apparently-validated answer and connects to an attacker-controlled IP. No public exploit code was provided, but the fix commit ships a conformance test that corrupts an RRSIG byte and demonstrates the bogus answer being accepted.