Vulnerability RUSTSEC-2026-0530

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation accepted the NSEC record that a parent zone signs at a delegation as proof that names below the zone cut, or other types at the cut, do not exist. Such a record only proves that no DS record exists there (RFC 6840 section 4.1). Someone who can answer or modify DNS responses could replay the parent's genuine signed records to get a denial for an existing name in the child zone accepted as secure.

From 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.