Vulnerability RUSTSEC-2026-0488
Summary
Integer underflow when reporting a malformed TSIG record
Details
When a TSIG record is decoded from the DNS wire format, its MAC length and "other data" length are checked against the end of the record data. If a check failed, the error value was built from end_idx - decoder.index(). For a malformed record the decoder can already be past end_idx, so this unsigned subtraction underflows.
In builds with overflow checks enabled (the dev profile by default) the underflow panics, so a peer that sends a crafted TSIG record can crash the process. In builds without overflow checks the result wraps and is only used in the returned error.
The fix returns a plain "insufficient bytes" error without the subtraction. It is in 0.26.2.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
