Vulnerability RUSTSEC-2026-0519

Unknown

2 months ago

NXDOMAIN accepted for an empty non-terminal that the NSEC record proves exists

>=0.0.0-0 <0.26.2

Summary

NXDOMAIN accepted for an empty non-terminal that the NSEC record proves exists

Details

When an NSEC record's next domain name is below the queried name, the queried name exists as an empty non-terminal (RFC 8020 section 3.1). The NSEC validator did not check for this case and accepted an NXDOMAIN response backed by such a record as secure.

The response code is not covered by any signature. An attacker who can modify DNS responses can take a genuine signed NODATA response for an empty non-terminal, change its response code to NXDOMAIN, and have the validator accept that an existing name does not exist.

This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.

The fix rejects NXDOMAIN as bogus, and validates NODATA as secure, when the covering NSEC record's next domain name is below the queried name and is not the zone apex. It is in 0.26.2.