Vulnerability RUSTSEC-2026-0531

Medium Risk

2 months ago

Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record (hickory-proto)

>=0.0.0-0 <0.26.0-beta.1

Summary

Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record (hickory-proto)

Details

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation accepted an NSEC or NSEC3 record from the child side of a zone cut, which has the SOA bit set, as proof that the parent has no DS record for the delegation (RFC 4035 section 5.2, RFC 6840 section 4.4). Someone who can answer or modify DNS responses could make a secure delegation look insecure and then forge records in the child zone.

From 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.