DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records.
Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2022-1026" }