RUSTSEC-2026-0540

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0540

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0540.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0540

Aliases

CVE-2026-123591
GHSA-7php-9j59-g3ch
RUSTSEC-2026-0531

Published

2026-09-03T12:00:00Z

Modified

2026-11-13T12:55:54Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record

Details

To show that a delegation is insecure, a validator needs proof that the parent zone has no DS record for it. That proof must come from the parent side of the zone cut: RFC 4035 section 5.2, RFC 5155 section 8.9 and RFC 6840 section 4.4 require the matching NSEC or NSEC3 record not to have the SOA bit set, since a record with SOA comes from the child zone's apex.

DNSSEC validation did not check this. An attacker who can answer or modify DNS responses can answer a DS query with the child zone's own signed NSEC or NSEC3 record for its apex, which does not list DS, and have the validator accept that the delegation is insecure. Records in the child zone can then be forged without any signature.

This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.

The fix treats a NODATA proof for a DS query as bogus when the directly matching NSEC or NSEC3 record has SOA in its type bitmap. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-net

Package

Name: hickory-net; View open source insights on deps.dev
Purl: pkg:cargo/hickory-net

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}