RUSTSEC-2026-0506

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0506

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0506.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0506

Aliases

CVE-2026-123601
GHSA-588m-chg6-8jqj
RUSTSEC-2026-0504

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:10:49Z

Summary

Inverted NSEC3 comparison lets one record "prove" that almost any name does not exist

Details

When DNSSEC validation looks for the NSEC3 record that covers a hashed name, the last record in the zone's hash chain needs special handling, because its next hashed owner name sorts before its own hash. For that record the two comparisons were reversed: it was treated as covering every hash below its owner hash or above its next hash, which is mostly the part of the chain it does not cover.

An attacker who can answer or modify DNS responses can replay that one signed NSEC3 record, with its RRSIG, from the target zone and use it in forged negative answers. The validator then accepts proof that names which do exist have no records.

This affects DNSSEC validation through DnssecDnsHandle (resolver, recursor and client) when built with dnssec-ring or dnssec-aws-lc-rs. The same code was in hickory-proto before it moved to hickory-net.

The fix corrects the comparison in find_covering_record. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-net

Package

Name: hickory-net; View open source insights on deps.dev
Purl: pkg:cargo/hickory-net

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}