OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-93657

HIGH · CVSS 7.5 EPSS 0.40% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-18 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

Versions of hickory-resolver prior to 0.26.2 are vulnerable to a flaw that allows attackers to exploit the Resolver::lookup() and Resolver::lookup_ip() APIs, returning invalid DNSSEC records as valid. This vulnerability can lead to the acceptance of forged DNS records, undermining DNSSEC authentication and potentially redirecting users to malicious sites. Organizations utilizing hickory-resolver should prioritize patching to mitigate the risk of DNS spoofing attacks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-93657
Severity
HIGH
CVSS
7.5
EPSS
0.40%

Original NVD Description

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.