RUSTSEC-2026-0519

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0519

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0519.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0519

Aliases

CVE-2026-123594
GHSA-86vr-jm6c-7cpg
RUSTSEC-2026-0511

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:40:42Z

Summary

NXDOMAIN accepted for an empty non-terminal that the NSEC record proves exists

Details

When an NSEC record's next domain name is below the queried name, the queried name exists as an empty non-terminal (RFC 8020 section 3.1). The NSEC validator did not check for this case and accepted an NXDOMAIN response backed by such a record as secure.

The response code is not covered by any signature. An attacker who can modify DNS responses can take a genuine signed NODATA response for an empty non-terminal, change its response code to NXDOMAIN, and have the validator accept that an existing name does not exist.

This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.

The fix rejects NXDOMAIN as bogus, and validates NODATA as secure, when the covering NSEC record's next domain name is below the queried name and is not the zone apex. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-net

Package

Name: hickory-net; View open source insights on deps.dev
Purl: pkg:cargo/hickory-net

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}