Repository navigation
Update Rust crate hickory-resolver to 0.26.0 [SECURITY] - #11447
Closed
oxide-renovate[bot] wants to merge 1 commit into
Closed
oxide-renovate[bot] wants to merge 1 commit into
oxide-renovate[bot] wants to merge 1 commit into
Conversation
oxide-renovate
Bot
added
the
dependencies
Collaborator
|
This isn't going to work on its own, the API changes from hickory 0.25 to 0.26 are significant enough to warrant an RFD on the topic. https://rfd.shared.oxide.computer/rfd/0729 |
Contributor
Author
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
oxide-renovate
Bot
deleted the
renovate/crate-hickory-resolver-vulnerability
branch
October 7, 2026 17:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.25.2→0.26.0hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
GHSA-5j98-2g5x-46v6
More information
Details
When calling
Resolver::lookup()orResolver::lookup_ip()on a resolver with DNSSEC validation enabled, both methods returnOk(...)if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hickory-resolver follows irrelevant CNAME records
GHSA-6f2x-v7q7-m7m5
More information
Details
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
hickory-dns/hickory-dns (hickory-resolver)
v0.26.2Compare Source
This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.
This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.
Resolved advisories:
TrustAnchorsdoes not check name of DNSKEYName::hashdiscards label boundaries;ValidationCacheKey(u64)reuses the digest inEqimplementation, leaking an Insecure DNSSEC verdict across distinct owner namesNameServerPool::try_send(resource-exhaustion DoS)Special thanks go out to @qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @ATinyShoe, @kirk-baird, @thesmartshadow, @BeaCox, @jpds, @N0zoM1z0, and @JasonPap for reporting vulnerabilities as well.
If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @djc for commercial support.
What's Changed
Ed25519key encoding (0.26 backport) by @djc in #3772New Contributors
Full Changelog: hickory-dns/hickory-dns@v0.26.1...v0.26.2
v0.26.1Compare Source
This point release for the 0.26 release series brings in several bug fixes, and no user-facing changes. Two security reports are addressed:
RUSTSEC-2026-0120 and RUSTSEC-2026-0119.
What's Changed
Full Changelog: hickory-dns/hickory-dns@v0.26.0...v0.26.1
v0.26.0: 0.26.0Compare Source
13 months after the release of 0.25.0, we finally have a bigger feature release of Hickory DNS, the suite of DNS libraries and authoritative/recursive name servers written in pure Rust. A lot of work has gone into this release, so we wanted to take a moment to release this before we continue work on deploying the Hickory DNS recursive resolver at Let's Encrypt (and did you see that Hickory is being used in some of Google's Pixel devices?). Because of the ongoing work, we expect that 0.27.0 might happen quite a bit sooner than in 13 months from now.
These release notes describe a number of high-level improvements as well as API changes that are likely to break a larger fraction of our downstream users. Feedback (both on these notes and the release itself) is always welcome in our issue tracker or via our Discord server.
Most of the following notes are broken up by specific components: the server binary and our library crates. However, for this release we've made several changes to the structure of our crates itself:
clientmodule (#3366). No future releases of the hickory-client crate are expected.recursorfeature which must be enabled explicitly. The recursor implementation was already tightly coupled to the resolver internals, so keeping it separate didn't really make sense.Additionally, substantial cross-crate changes have been made to improve our error handling:
hickory-dns (the server binary)
hickory-server (the library API)
Authoritytrait was renamed toZoneHandlerand simplified to better reflect its usage:hickory-resolver
We made many improvements to improve correctness and efficiency of both the recursive resolver and the "stub" resolver. In addition, we want to highlight the following changes:
hickory-net
We made substantial improvements to DNSSEC validation and our handling of potentially spoofing messages.
hickory-proto
Details
For more details, review the detailed release notes for our pre-releases:
and these final PRs merged after beta 4:
Thanks
Finally, we want to thank everyone who contributed to this release: @bryanlarsen, @billf, @hargut, @ibigbug, @xi0, @steffengy, @james7132, @Thomasdezeeuw, @Kriskras99, @mispp, @conradludgate, @nabijaczleweli, @musicinmybrain, @msrd0, @jmwample, @LAGonauta, @tisonkun, @provokateurin, @lemon-sh, @thomas-zahner, @jpds, @lpraneis, @zachsmith1, @jackboykin, @ZnqbuZ, @Jeidnx, @kn0sys, @matheus23, @benesch, @roblabla and of course our maintainers @cpu, @divergentdave, @marcus0x62 and @djc.
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.