RUSTSEC-2026-0514

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0514

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0514.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0514

Aliases

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:30:06Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

`Resolver::lookup` and `lookup_ip` returned records that failed DNSSEC validation

Details

With DNSSEC validation enabled, Resolver::lookup() and Resolver::lookup_ip() returned Ok with the records even when validation found the response bogus. The result was only visible in each record's proof status, which callers had to inspect themselves.

Applications that enable validation and treat a successful lookup as validated data would therefore accept forged or tampered answers from anyone who can answer or modify their DNS traffic.

From 0.26.2 a lookup whose records are bogus fails with a "DNSSEC validation failed" error (DnsError::DnssecBogus), the error is not retried, and the hickory-server forwarder answers SERVFAIL for it.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-resolver

Package

Name: hickory-resolver; View open source insights on deps.dev
Purl: pkg:cargo/hickory-resolver

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}