GHSA-5j98-2g5x-46v6

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

Published

2026-10-05

Modified

2026-10-05

Sources

github-advisory

Summary

When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.

Affected packages

Remediation: Upgrade to 0.26.2 or later.

References

• https://github.com/advisories/GHSA-5j98-2g5x-46v6