RUSTSEC-2026-0488

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0488

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0488.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0488

Aliases

CVE-2026-123571
GHSA-x962-5xwx-fr8x

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T09:45:02Z

Summary

Integer underflow when reporting a malformed TSIG record

Details

When a TSIG record is decoded from the DNS wire format, its MAC length and "other data" length are checked against the end of the record data. If a check failed, the error value was built from end_idx - decoder.index(). For a malformed record the decoder can already be past end_idx, so this unsigned subtraction underflows.

In builds with overflow checks enabled (the dev profile by default) the underflow panics, so a peer that sends a crafted TSIG record can crash the process. In builds without overflow checks the result wraps and is only used in the returned error.

The fix returns a plain "insufficient bytes" error without the subtraction. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.26.0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}