CVE-2026-93657

A flaw was found in hickory-resolver. This vulnerability allows attackers to bypass Domain Name System Security Extensions (DNSSEC) authentication checks. By controlling the answering zone or being positioned on the network path, an attacker can have forged DNS records accepted as validated, leading to the acceptance of invalid records as successful results.

This vulnerability is rated as Important because an attacker can forge DNS responses that bypass cryptographic validation, potentially redirecting network communications or serving fraudulent cryptographic keys to trusting applications. In Red Hat environments, the hickory-resolver crate is statically embedded within specific tools such as Sequoia PGP utilities and containerized OpenShift AI services. While exploitation requires an adversary to either control an authoritative name server or intercept network traffic, successful attacks undermine DNSSEC integrity protections without detection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.