RUSTSEC-2026-0504

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0504

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0504.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0504

Aliases

CVE-2026-123601
GHSA-588m-chg6-8jqj
RUSTSEC-2026-0506

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:10:49Z

Summary

Inverted NSEC3 comparison in DNSSEC validation (hickory-proto 0.25)

Details

In hickory-proto 0.25.0 through 0.26.0-alpha.1, DNSSEC validation handled the last NSEC3 record of a zone's hash chain with its two comparisons reversed. That record was treated as covering almost every hash it does not cover, so an attacker who can answer or modify DNS responses could replay it, with its RRSIG, to forge proofs that existing names have no records.

From 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in hickory-proto 0.25 (directly or through hickory-resolver or hickory-recursor 0.25) should move to the 0.26.2 or later releases, which validate through hickory-net.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.25.0

Fixed

0.26.0-beta.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}