7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
GHSA-5j98-2g5x-46v6 only affects hickory-resolver Resolver::lookup() and Resolver::lookup_ip() on a resolver with DNSSEC validation enabled. In codex, hickory-resolver 0.25.2 is pulled in only by rama-dns 0.3.0-alpha.4, which depends on it with default features disabled and only the "tokio" and "system-config" features; no crate in the build enables the dnssec-ring or dnssec-aws-lc-rs features. The dependency data embedded in the shipped binaries confirms hickory-proto 0.25.2 was built without the bitflags, time and rustls-pki-types dependencies that its DNSSEC support requires, so DNSSEC validation code is not compiled into the package.
Status