hickory-resolver before 0.26.2 DNSSEC Validation Bypass
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.2%
exploitation probability
0.2%top 86% of all CVEs
observed exploitation
nono source reports it
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
hickory-dns · hickory-resolverReferences
https://github.com/hickory-dns/hickory-dnshttps://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238https://github.com/hickory-dns/hickory-dns/pull/3871https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass