CVE-2026-93657

7.5 HIGHpublic exploit available

Published 2026-09-18 · Updated 2026-09-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE-347

Public exploit & PoC references

https://github.com/hickory-dns/hickory-dns
https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238
https://github.com/hickory-dns/hickory-dns/pull/3871
https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6

All references

https://github.com/hickory-dns/hickory-dns
https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238
https://github.com/hickory-dns/hickory-dns/pull/3871
https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6
https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-71422PoC
HIGHCVE-2026-100293
HIGHCVE-2026-102266PoC
CRITICALCVE-2026-102268PoC
HIGHCVE-2026-102271PoC
HIGHCVE-2026-102272PoC
HIGHCVE-2026-102273PoC
UNSCOREDCVE-2026-102508

Related by shared AI tags and CWE weakness class. Browse the full archive.