# CVE-2026-93657: hickory-resolver DNSSEC validation bypass in lookup APIs

Source: https://junglewise.ai/threats/cve-2026-93657-hickory-resolver-dnssec-validation-bypass-in-lookup-apis  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93657 · Severity: high · CVSS 7.5 · Published 2026-09-18

hickory-resolver is a Rust-based DNS resolver library used by applications to perform secure domain name lookups. A flaw in versions before 0.26.2 causes the resolver to incorrectly accept forged DNS records that should have failed DNSSEC validation, potentially allowing attackers to redirect users to malicious sites or intercept communications if they control the DNS zone or network path.

Technologies: [hickory-resolver (crates.io)](https://junglewise.ai/threats/technologies/crates-io-hickory-resolver), [Hickory-Dns Hickory-Resolver](https://junglewise.ai/threats/technologies/hickory-resolver). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Hickory-Dns](https://junglewise.ai/threats/vendors/hickory-dns).

## Quick answers

**Is CVE-2026-93657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93657 being exploited in the wild.

**How severe is CVE-2026-93657?** High severity, with a CVSS score of 7.5, published 18 September 2026.

**Which products and versions are affected?** hickory-resolver (crates.io) SEMVER:introduced=0,fixed=0.26.2; Hickory-Dns Hickory-Resolver before 0.26.2.

**Is there a fix for CVE-2026-93657?** Yes. hickory-resolver (crates.io): upgrade to 0.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93657 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93657?** Check whether you run hickory-resolver (crates.io) or Hickory-Dns Hickory-Resolver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hickory-resolver (crates.io): upgrade to 0.26.2 or later

  ```sh
  cargo update -p hickory-resolver
  ```


## Technical details

The vulnerability is a DNSSEC validation bypass in the Resolver::lookup() and Resolver::lookup_ip() API methods. The root cause is a failure to properly propagate bogus DNSSEC proof states up through the resolver's call chain, resulting in invalid DNS records being returned as if they passed validation. An attacker positioned on the network or controlling an authoritative zone can exploit this by presenting forged DNS records. The vulnerability requires no authentication or user interaction; exploitation is possible via direct DNS queries. The fix is available in hickory-resolver version 0.26.2 and later.

## Affected products

- hickory-dns hickory-resolver before 0.26.2

## Identifiers

- CVE-2026-93657
- GHSA-5j98-2g5x-46v6

## Timeline

- 2026-09-18: disclosed

## References

- [https://crates.io/](https://crates.io/)
- [https://github.com/hickory-dns/hickory-dns](https://github.com/hickory-dns/hickory-dns)

## Related threats

- [hickory-dns recursor glueless-NS referral amplification](https://junglewise.ai/threats/cve-2026-123606-the-hickory-dns-recursor-in-hickory-recursor-0-25-0-alpha-3)
- [Hickory DNS hickory-resolver unbounded retry loop resource exhaustion](https://junglewise.ai/threats/cve-2026-123604-hickory-dns-hickory-resolver-0-26-0-beta-1-before-0-26-2)
- [Hickory DNS IPv4-mapped IPv6 canonicalization bypass](https://junglewise.ai/threats/cve-2026-123603-hickory-proto-and-hickory-resolver-0-26-0-before-0-26-2-hickory)
- [Hickory DNS recursor cache poisoning via ghost domain attack](https://junglewise.ai/threats/cve-2026-123602-the-hickory-dns-recursor-in-all-versions-of-hickory-recursor-and)
- [Hickory DNS recursive resolver denial of service via cached empty connection pool](https://junglewise.ai/threats/cve-2026-123588-the-recursive-resolver-in-hickory-dns-all-versions-of-the)