Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by hickory-dns
CVE-2026-93657 (GCVE-0-2026-93657)
Vulnerability from nvd – Published: 2026-09-18 14:23 – Updated: 2026-09-21 20:51
VLAI
EPSS
VEX
Title
hickory-resolver before 0.26.2 DNSSEC Validation Bypass
Summary
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:28 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://github.com/hickory-dns/hickory-dns/commit… | patch |
| https://github.com/hickory-dns/hickory-dns/pull/3871 | patchissue-tracking |
| https://github.com/hickory-dns/hickory-dns/releas… | release-notes |
| https://github.com/hickory-dns/hickory-dns | product |
| https://www.vulncheck.com/advisories/hickory-reso… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-resolver |
Affected:
0 , < 0.26.2
(semver)
Unaffected: 0.26.2 (semver) |
Date Public
2026-09-03 21:04
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:28:49.154433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:51:40.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io",
"defaultStatus": "unaffected",
"packageName": "hickory-resolver",
"packageURL": "pkg:cargo/hickory-resolver",
"product": "hickory-resolver",
"repo": "https://github.com/hickory-dns/hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ali Firas (thesmartshadow)"
}
],
"datePublic": "2026-09-03T21:04:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:23:20.181Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5j98-2g5x-46v6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6"
},
{
"name": "Return error from Resolver::lookup() if bogus",
"tags": [
"patch"
],
"url": "https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238"
},
{
"name": "Pull Request #3871",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/hickory-dns/hickory-dns/pull/3871"
},
{
"name": "hickory-resolver v0.26.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/hickory-dns/hickory-dns"
},
{
"name": "VulnCheck Advisory: hickory-resolver before 0.26.2 DNSSEC Validation Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass"
}
],
"title": "hickory-resolver before 0.26.2 DNSSEC Validation Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93657",
"datePublished": "2026-09-18T14:23:20.181Z",
"dateReserved": "2026-09-18T13:30:25.560Z",
"dateUpdated": "2026-09-21T20:51:40.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-25188 (GCVE-0-2025-25188)
Vulnerability from nvd – Published: 2025-02-10 17:35 – Updated: 2025-02-12 15:47
VLAI
EPSS
VEX
Title
DNSSEC validation may accept broken authentication chains
Summary
Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Versions 0.24.3 and 0.25.0-alpha.5 fix the issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-10 17:56 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | x_refsource_CONFIRM |
| https://github.com/hickory-dns/hickory-dns/commit… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
>= 0.8.0, < 0.24.3
Affected: >= 0.25.0-alpha.1, < 0.25.0-alpha.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-25188",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-10T17:56:07.547520Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T15:47:59.943Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.8.0, \u003c 0.24.3"
},
{
"status": "affected",
"version": "\u003e= 0.25.0-alpha.1, \u003c 0.25.0-alpha.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Versions 0.24.3 and 0.25.0-alpha.5 fix the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-10T17:35:25.265Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-37wc-h8xc-5hc4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-37wc-h8xc-5hc4"
},
{
"name": "https://github.com/hickory-dns/hickory-dns/commit/e118c6eec569f4340421f86ee0686714010c63e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hickory-dns/hickory-dns/commit/e118c6eec569f4340421f86ee0686714010c63e9"
}
],
"source": {
"advisory": "GHSA-37wc-h8xc-5hc4",
"discovery": "UNKNOWN"
},
"title": "DNSSEC validation may accept broken authentication chains"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-25188",
"datePublished": "2025-02-10T17:35:25.265Z",
"dateReserved": "2025-02-03T19:30:53.399Z",
"dateUpdated": "2025-02-12T15:47:59.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-93657 (GCVE-0-2026-93657)
Vulnerability from cvelistv5 – Published: 2026-09-18 14:23 – Updated: 2026-09-21 20:51
VLAI
EPSS
VEX
Title
hickory-resolver before 0.26.2 DNSSEC Validation Bypass
Summary
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:28 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://github.com/hickory-dns/hickory-dns/commit… | patch |
| https://github.com/hickory-dns/hickory-dns/pull/3871 | patchissue-tracking |
| https://github.com/hickory-dns/hickory-dns/releas… | release-notes |
| https://github.com/hickory-dns/hickory-dns | product |
| https://www.vulncheck.com/advisories/hickory-reso… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-resolver |
Affected:
0 , < 0.26.2
(semver)
Unaffected: 0.26.2 (semver) |
Date Public
2026-09-03 21:04
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:28:49.154433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:51:40.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io",
"defaultStatus": "unaffected",
"packageName": "hickory-resolver",
"packageURL": "pkg:cargo/hickory-resolver",
"product": "hickory-resolver",
"repo": "https://github.com/hickory-dns/hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ali Firas (thesmartshadow)"
}
],
"datePublic": "2026-09-03T21:04:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:23:20.181Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5j98-2g5x-46v6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6"
},
{
"name": "Return error from Resolver::lookup() if bogus",
"tags": [
"patch"
],
"url": "https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238"
},
{
"name": "Pull Request #3871",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/hickory-dns/hickory-dns/pull/3871"
},
{
"name": "hickory-resolver v0.26.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/hickory-dns/hickory-dns"
},
{
"name": "VulnCheck Advisory: hickory-resolver before 0.26.2 DNSSEC Validation Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-resolver-before-0.26.2-dnssec-validation-bypass"
}
],
"title": "hickory-resolver before 0.26.2 DNSSEC Validation Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93657",
"datePublished": "2026-09-18T14:23:20.181Z",
"dateReserved": "2026-09-18T13:30:25.560Z",
"dateUpdated": "2026-09-21T20:51:40.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-25188 (GCVE-0-2025-25188)
Vulnerability from cvelistv5 – Published: 2025-02-10 17:35 – Updated: 2025-02-12 15:47
VLAI
EPSS
VEX
Title
DNSSEC validation may accept broken authentication chains
Summary
Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Versions 0.24.3 and 0.25.0-alpha.5 fix the issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-10 17:56 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | x_refsource_CONFIRM |
| https://github.com/hickory-dns/hickory-dns/commit… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
>= 0.8.0, < 0.24.3
Affected: >= 0.25.0-alpha.1, < 0.25.0-alpha.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-25188",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-10T17:56:07.547520Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T15:47:59.943Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.8.0, \u003c 0.24.3"
},
{
"status": "affected",
"version": "\u003e= 0.25.0-alpha.1, \u003c 0.25.0-alpha.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Versions 0.24.3 and 0.25.0-alpha.5 fix the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-10T17:35:25.265Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-37wc-h8xc-5hc4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-37wc-h8xc-5hc4"
},
{
"name": "https://github.com/hickory-dns/hickory-dns/commit/e118c6eec569f4340421f86ee0686714010c63e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hickory-dns/hickory-dns/commit/e118c6eec569f4340421f86ee0686714010c63e9"
}
],
"source": {
"advisory": "GHSA-37wc-h8xc-5hc4",
"discovery": "UNKNOWN"
},
"title": "DNSSEC validation may accept broken authentication chains"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-25188",
"datePublished": "2025-02-10T17:35:25.265Z",
"dateReserved": "2025-02-03T19:30:53.399Z",
"dateUpdated": "2025-02-12T15:47:59.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}