Name: CVE-2026-93657: Improper Verification of Cryptographic Signature
Creator: Rapid7
Published: 2026-09-18T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-93657, CWE-347, CVSS 7.5, EPSS 0.0023

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

CVSS Details

CVSS 4.0 Base Score: 8.7 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade sequoia-sq	Oct 27, 2026	Oct 20, 2026
Oracle_linux	—	Upgrade sequoia-sq	Oct 22, 2026	Sep 18, 2026
Redhat_linux	—	Upgrade rust-sequoia-sq-debugsourceUpgrade sequoia-sq-debuginfoNo solution existsUpgrade sequoia-sq	Sep 24, 2026	Sep 18, 2026
Rocky_linux	—	Upgrade rust-sequoia-sq-debugsourceUpgrade sequoia-sqUpgrade sequoia-sq-debuginfo	Oct 23, 2026	Oct 21, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence