RUSTSEC-2026-0520

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0520

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0520.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0520

Aliases

CVE-2026-123581
GHSA-929p-gjf6-5hqj
RUSTSEC-2026-0512

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:40:54Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

DNSSEC validation accepted a validly signed but unrelated RRset as the answer

Details

When a response had a non-empty answer section, DNSSEC validation treated it as a positive answer as long as the records in it validated. It did not check that any of those records had the queried name and either the queried type or type CNAME.

An attacker who can answer or modify DNS responses can therefore return a genuine, signed RRset for some other name or type, and have it accepted as a validated answer to the query instead of being handled as a response with no matching data.

This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.

The fix requires at least one answer record that matches the query name and is either of the queried type or a CNAME, both for positive responses and when NSEC records are checked. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-net

Package

Name: hickory-net; View open source insights on deps.dev
Purl: pkg:cargo/hickory-net

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}