RUSTSEC-2026-0509

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0509

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0509.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0509

Aliases

CVE-2026-123580
GHSA-p2jv-r3m3-7wf4
RUSTSEC-2026-0505

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:10:38Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

NSEC3 records from another zone were accepted in proofs of nonexistence

Details

When DNSSEC validation used NSEC3 records to prove that a name or record type does not exist, it compared only the hashed first label of each NSEC3 owner name with the hash of the name being checked. The rest of the owner name, which says which zone the record belongs to, was not checked.

Someone who controls any DNSSEC-signed zone can publish a signed NSEC3 record whose first label is the hash of a name in another zone. An attacker who can answer or modify DNS responses can then use it to make the validator accept that the name in the other zone does not exist.

This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.

The fix requires a matching NSEC3 record to belong to a zone that contains the checked name, and ignores NSEC3 records whose owner is not directly below the RRSIG signer name. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-net

Package

Name: hickory-net; View open source insights on deps.dev
Purl: pkg:cargo/hickory-net

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}