Vulnerability RUSTSEC-2026-0520

Medium Risk

2 months ago

DNSSEC validation accepted a validly signed but unrelated RRset as the answer

>=0.0.0-0 <0.26.2

Summary

DNSSEC validation accepted a validly signed but unrelated RRset as the answer

Details

When a response had a non-empty answer section, DNSSEC validation treated it as a positive answer as long as the records in it validated. It did not check that any of those records had the queried name and either the queried type or type CNAME.

An attacker who can answer or modify DNS responses can therefore return a genuine, signed RRset for some other name or type, and have it accepted as a validated answer to the query instead of being handled as a response with no matching data.

This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.

The fix requires at least one answer record that matches the query name and is either of the queried type or a CNAME, both for positive responses and when NSEC records are checked. It is in 0.26.2.