Hulios

Hulios Hardened Universal Linux Invisibility and Onion System Hulios is an eBPF-powered, transparent Tor VPN gateway for Linux. It secures outbound network traffic by redirecting TCP sockets and DNS queries through an embedded Arti Tor client instance and a localized Hickory-based DNS resolver. B...

hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records

A flaw was found in hickory-resolver. This vulnerability allows attackers to bypass Domain Name System Security Extensions DNSSEC authentication checks. By controlling the answering zone or being positioned on the network path, an attacker can have forged DNS records accepted as validated, leadin...

Important: Red Hat Security Advisory: rust-sequoia-sq security update

An update for rust-sequoia-sq is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

GHSA-6F2X-V7Q7-M7M5 hickory-resolver follows irrelevant CNAME records

When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...

hickory-resolver follows irrelevant CNAME records

When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

When the hickory-resolver name server pool implementation receives an upstream response with the TC truncated header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no...

GHSA-6W6G-HM98-MHGM hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

When the hickory-resolver name server pool implementation receives an upstream response with the TC truncated header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no...

GHSA-5J98-2G5X-46V6 hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup or Resolver::lookupip on a resolver with DNSSEC validation enabled, both methods return Ok... if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSS...

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup or Resolver::lookupip on a resolver with DNSSEC validation enabled, both methods return Ok... if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSS...

async-std-resolver (>=0.24.0, <=0.25.0-alpha.5) potentially affected by CVE-2026-93657 via hickory-resolver (>=0.24.4, <=0.25.0-alpha.5)

hickory-resolver CARGO version =0.24.4, =0.24.0, =0.25.0-alpha.5 Source cves: CVE-2026-93657 Source advisory: OSV:GHSA-5J98-2G5X-46V6...

async-std-resolver (>=0.24.0, <=0.25.0-alpha.5) potentially affected by unknown CVE via hickory-resolver (>=0.24.4, <=0.25.0-alpha.5)

hickory-resolver CARGO version =0.24.4, =0.24.0, =0.25.0-alpha.5 Source cves: unknown CVE Source advisory: GHSA-5J98-2G5X-46V6...

CVE-2026-93657

A flaw was found in hickory-resolver. This vulnerability allows attackers to bypass Domain Name System Security Extensions DNSSEC authentication checks. By controlling the answering zone or being positioned on the network path, an attacker can have forged DNS records accepted as validated, leadin...

SUSE CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

Linux Distros Unpatched Vulnerability : CVE-2026-93657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid...

DEBIAN-CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

UBUNTU-CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657 hickory-resolver before 0.26.2 DNSSEC Validation Bypass

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...