RUSTSEC-2026-0531

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0531

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0531.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0531

Aliases

CVE-2026-123591
GHSA-7php-9j59-g3ch
RUSTSEC-2026-0540

Published

2026-09-03T12:00:00Z

Modified

2026-11-13T12:55:54Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record (hickory-proto)

Details

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation accepted an NSEC or NSEC3 record from the child side of a zone cut, which has the SOA bit set, as proof that the parent has no DS record for the delegation (RFC 4035 section 5.2, RFC 6840 section 4.4). Someone who can answer or modify DNS responses could make a secure delegation look insecure and then forge records in the child zone.

From 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.0-beta.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}