Vulnerability RUSTSEC-2026-0514

High Risk

2 months ago

`Resolver::lookup` and `lookup_ip` returned records that failed DNSSEC validation

>=0.0.0-0 <0.26.2

Summary

`Resolver::lookup` and `lookup_ip` returned records that failed DNSSEC validation

Details

With DNSSEC validation enabled, Resolver::lookup() and Resolver::lookup_ip() returned Ok with the records even when validation found the response bogus. The result was only visible in each record's proof status, which callers had to inspect themselves.

Applications that enable validation and treat a successful lookup as validated data would therefore accept forged or tampered answers from anyone who can answer or modify their DNS traffic.

From 0.26.2 a lookup whose records are bogus fails with a "DNSSEC validation failed" error (DnsError::DnssecBogus), the error is not retried, and the hickory-server forwarder answers SERVFAIL for it.