RUSTSEC-2026-0532

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0532

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0532.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0532

Aliases

CVE-2026-123595
GHSA-624w-vvww-xvpw
RUSTSEC-2026-0541

Published

2026-09-03T12:00:00Z

Modified

2026-11-13T12:55:46Z

Summary

Parent-side NSEC3 at a zone cut accepted as proof of nonexistence (hickory-proto 0.25)

Details

In hickory-proto 0.25.0 through 0.26.0-alpha.1, NSEC3 validation picked the closest encloser by hashed owner name alone and accepted the NSEC3 record that a parent zone signs at a delegation as proof that names at or below the zone cut do not exist. Such a record only proves that no DS record exists there (RFC 6840 section 4.1, RFC 5155 section 8.3). Someone who can answer or modify DNS responses could replay the parent's genuine signed records to get a denial for an existing name in the child zone accepted as secure.

From 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in hickory-proto 0.25 (directly or through hickory-resolver or hickory-recursor 0.25) should move to the 0.26.2 or later releases, which validate through hickory-net.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.25.0

Fixed

0.26.0-beta.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}