[PR #357] [CLOSED] chore(deps): bump hickory-resolver from 0.26.1 to 0.26.2 #376

New issue

Closed

opened 2026-10-29 14:22:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:22:45 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/357
Author: @dependabot[bot]
Created: 10/10/2026
Status: ❌ Closed

Base: main ← Head: dependabot/cargo/hickory-resolver-0.26.2

📝 Commits (1)

4e092b6 chore(deps): bump hickory-resolver from 0.26.1 to 0.26.2

📊 Changes

1 file changed (+5 additions, -5 deletions)

View changed files

📝 Cargo.lock (+5 -5)

📄 Description

Bumps hickory-resolver from 0.26.1 to 0.26.2.

Release notes

Sourced from hickory-resolver's releases.

v0.26.2

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone

GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records

GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN

GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence

GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records

GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3

GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut

GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut

GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks

GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion

GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names

GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists

GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses

GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer

GHSA-j2rc-wxwh-62g9: TrustAnchors does not check name of DNSKEY

GHSA-rx82-4p2j-j5cv: Name::hash discards label boundaries; ValidationCacheKey(u64) reuses the digest in Eq implementation, leaking an Insecure DNSSEC verdict across distinct owner names

GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries

GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled

GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS

GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS

GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines

GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section

GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses

GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)

GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor

GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget

GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses

GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing

GHSA-2f4m-fq7w-mrgx: Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies

GHSA-g8wg-4mwh-fjfv: DoQ server has no timeout when reading request

GHSA-5r56-v84h-c3w5: DoH request body is buffered without a size limit

GHSA-6f2x-v7q7-m7m5: Resolver follows irrelevant CNAME records

GHSA-xv7c-h5g9-x25x: transient DS-fetch error inappropriately cached as BOGUS

GHSA-9px7-7m25-f6q2: Recursive resolver: Empty connection pool is cached after failed IP lookup

GHSA-29q9-p769-j8gq: Bogus answers cached for the attacker-supplied record TTL

GHSA-4jwp-xjwm-333g: Missing IPv4-Mapped IPv6 address canonicalization

Special thanks go out to @qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @ATinyShoe, @kirk-baird, @thesmartshadow, @BeaCox, @jpds, @N0zoM1z0, and @JasonPap for reporting vulnerabilities as well.

If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @djc for commercial support.

What's Changed

... (truncated)

Commits

48323ef Bump version to 0.26.2
ccd6952 Only follow one CNAME record from each response
c04ad2b Better distinguish NODATA response and wildcards
64b4291 Add test for bogus wildcard expansion
478998b proto: constrain peer-controlled allocation sizes
8392769 resolver: avoid caching empty nameserver pools
e2d21d8 Replace use of SOA name with NSEC3 record parents
84fa8ab Check for correct zone name in covering NSEC3s too
09803ba Look for correct zone name in matching NSEC3s
26f45d3 Rename Nsec3RecordPair to Nsec3RecordInfo
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/357 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 10/10/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `dependabot/cargo/hickory-resolver-0.26.2` --- ### 📝 Commits (1) - [`4e092b6`](https://github.com/kvcache-ai/AgentENV/commit/4e092b635f2c8f41ad7d17268e13ce0fa97176da) chore(deps): bump hickory-resolver from 0.26.1 to 0.26.2 ### 📊 Changes **1 file changed** (+5 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+5 -5) </details> ### 📄 Description Bumps [hickory-resolver](https://github.com/hickory-dns/hickory-dns) from 0.26.1 to 0.26.2. <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/hickory-dns/hickory-dns/releases">hickory-resolver's releases</a>. <blockquote> <h2>v0.26.2</h2> This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues. This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers. Resolved advisories: <ul> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c">GHSA-2vgh-3wfw-qj7c</a>: RRSIG Signer's Name not checked against the RRset's zone</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6">GHSA-57pw-897j-v4j6</a>: Improper check of signature validity of NSEC and NSEC3 records</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wjgj-fvg9-65w9">GHSA-wjgj-fvg9-65w9</a>: DNSSEC validation ignores bogus records with a DNS class other than IN</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj">GHSA-588m-chg6-8jqj</a>: Inverted NSEC3 comparison allows forgery of proofs of nonexistence</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5">GHSA-qw83-5pm2-ggp5</a>: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3jvh-8vj5-65rq">GHSA-3jvh-8vj5-65rq</a>: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3r6v-f3jh-vvqm">GHSA-3r6v-f3jh-vvqm</a>: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw">GHSA-624w-vvww-xvpw</a>: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-7php-9j59-g3ch">GHSA-7php-9j59-g3ch</a>: DNSSEC validation is missing RFC 6840 §4.4 checks</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vrv5-968r-5ggm">GHSA-vrv5-968r-5ggm</a>: DNSSEC validation accepts bogus positive response with wildcard expansion</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4">GHSA-p2jv-r3m3-7wf4</a>: Nonexistence proof forgery due to insufficient checks on NSEC3 record names</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-86vr-jm6c-7cpg">GHSA-86vr-jm6c-7cpg</a>: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-8hq4-5836-w6q4">GHSA-8hq4-5836-w6q4</a>: Server does not check validation status of SOA record in negative responses</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6">GHSA-5j98-2g5x-46v6</a>: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj">GHSA-929p-gjf6-5hqj</a>: DNSSEC validation accepts responses with the wrong RRset as a positive answer</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9">GHSA-j2rc-wxwh-62g9</a>: <code>TrustAnchors</code> does not check name of DNSKEY</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-rx82-4p2j-j5cv">GHSA-rx82-4p2j-j5cv</a>: <code>Name::hash</code> discards label boundaries; <code>ValidationCacheKey(u64)</code> reuses the digest in <code>Eq</code> implementation, leaking an Insecure DNSSEC verdict across distinct owner names</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2hxp-x833-73f7">GHSA-2hxp-x833-73f7</a>: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-x962-5xwx-fr8x">GHSA-x962-5xwx-fr8x</a>: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wgfr-mphw-j5g4">GHSA-wgfr-mphw-j5g4</a>: Panic in zone file parser for SVCB and HTTPS</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5">GHSA-hx8c-fjhc-hmf5</a>: Panic in zone file parser for SVCB and HTTPS</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw">GHSA-4rph-pmrw-mwpw</a>: Zone file parser panics when parsing long lines</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3w89-7rx5-hpwx">GHSA-3w89-7rx5-hpwx</a>: Responses with QDCOUNT=0 bypass check for matching question section</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vcjp-57rr-mpfw">GHSA-vcjp-57rr-mpfw</a>: Out-of-bailiwick filtering is not applied to negative responses</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm">GHSA-6w6g-hm98-mhgm</a>: Unbounded TC-retry loop in <code>NameServerPool::try_send</code> (resource-exhaustion DoS)</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756">GHSA-cx5j-p54p-q756</a>: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6h5c-jjg5-wj59">GHSA-6h5c-jjg5-wj59</a>: Glueless-NS referral fan-out without per-query work budget</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-v44v-c8m4-gc43">GHSA-v44v-c8m4-gc43</a>: Denial of service of client UDP connections via spoofed malformed responses</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc">GHSA-67wc-6jq8-ghrc</a>: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2f4m-fq7w-mrgx">GHSA-2f4m-fq7w-mrgx</a>: Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-g8wg-4mwh-fjfv">GHSA-g8wg-4mwh-fjfv</a>: DoQ server has no timeout when reading request</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5r56-v84h-c3w5">GHSA-5r56-v84h-c3w5</a>: DoH request body is buffered without a size limit</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5">GHSA-6f2x-v7q7-m7m5</a>: Resolver follows irrelevant CNAME records</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-xv7c-h5g9-x25x">GHSA-xv7c-h5g9-x25x</a>: transient DS-fetch error inappropriately cached as BOGUS</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-9px7-7m25-f6q2">GHSA-9px7-7m25-f6q2</a>: Recursive resolver: Empty connection pool is cached after failed IP lookup</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-29q9-p769-j8gq">GHSA-29q9-p769-j8gq</a>: Bogus answers cached for the attacker-supplied record TTL</li> <li><a href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4jwp-xjwm-333g">GHSA-4jwp-xjwm-333g</a>: Missing IPv4-Mapped IPv6 address canonicalization</li> </ul> Special thanks go out to <a href="https://github.com/qifan-sailboat"><code>@qifan-sailboat</code></a> and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to <a href="https://github.com/ATinyShoe"><code>@ATinyShoe</code></a>, <a href="https://github.com/kirk-baird"><code>@kirk-baird</code></a>, <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>, <a href="https://github.com/BeaCox"><code>@BeaCox</code></a>, <a href="https://github.com/jpds"><code>@jpds</code></a>, <a href="https://github.com/N0zoM1z0"><code>@N0zoM1z0</code></a>, and <a href="https://github.com/JasonPap"><code>@JasonPap</code></a> for reporting vulnerabilities as well. If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact <a href="https://github.com/djc"><code>@djc</code></a> for commercial support. <h2>What's Changed</h2>  </blockquote> ... (truncated) </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/48323ef64b5a868734efdc584f089ae390ff436d"><code>48323ef</code></a> Bump version to 0.26.2</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832"><code>ccd6952</code></a> Only follow one CNAME record from each response</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/c04ad2be38a636f434794c54e2665e4b6568f6c8"><code>c04ad2b</code></a> Better distinguish NODATA response and wildcards</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/64b42916e00ba129673bd422a43a51e1306c61c9"><code>64b4291</code></a> Add test for bogus wildcard expansion</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/478998bdf3ee3d1c57a2c88a81bb3315cf5bce11"><code>478998b</code></a> proto: constrain peer-controlled allocation sizes</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/8392769e78cfa48b1c1547486c2393df8bab13b9"><code>8392769</code></a> resolver: avoid caching empty nameserver pools</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/e2d21d8aa6b43a26e6108a6af33157d565d35baa"><code>e2d21d8</code></a> Replace use of SOA name with NSEC3 record parents</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/84fa8ab9223f1d5ee3cf8de3e0a4f7711ad6d0d3"><code>84fa8ab</code></a> Check for correct zone name in covering NSEC3s too</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/09803ba00145e6ebf6e72bb72795192f98ed1f6d"><code>09803ba</code></a> Look for correct zone name in matching NSEC3s</li> <li><a href="https://github.com/hickory-dns/hickory-dns/commit/26f45d3e402eab10e00f59466d0827a6f1493707"><code>26f45d3</code></a> Rename Nsec3RecordPair to Nsec3RecordInfo</li> <li>Additional commits viewable in <a href="https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.2">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hickory-resolver&package-manager=cargo&previous-version=0.26.1&new-version=0.26.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/kvcache-ai/AgentENV/network/alerts). </details> --- 🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

bsakaguchi

2026-10-29 14:22:45 +00:00