RUSTSEC-2026-0511

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0511

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0511.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0511

Aliases

CVE-2026-123594
GHSA-86vr-jm6c-7cpg
RUSTSEC-2026-0519

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:40:42Z

Summary

NXDOMAIN accepted for a proven empty non-terminal (hickory-proto)

Details

Up to 0.26.0-alpha.1, hickory-proto's NSEC validation accepted an NXDOMAIN response as secure even when the covering NSEC record's next domain name was below the queried name, which proves the name exists as an empty non-terminal. Because the response code is not signed, someone who can modify DNS responses could turn a genuine signed NODATA response into an accepted NXDOMAIN.

From 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.0-beta.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}