1 line
2.1 KiB
JSON
1 line
2.1 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0539","published":"2026-09-03T12:00:00Z","modified":"2026-11-13T12:55:36.653610929Z","aliases":["CVE-2026-123596","GHSA-3r6v-f3jh-vvqm","RUSTSEC-2026-0530"],"summary":"Parent-side NSEC at a zone cut accepted as proof of nonexistence below the cut","details":"At a delegation, the parent zone signs an NSEC record for the child's name whose type bitmap has NS but not SOA (or has DNAME). RFC 6840 section 4.1 says such a record only proves that no DS record exists at that name. It says nothing about names below the cut or about other types at the cut, because those belong to the child zone.\n\nDNSSEC validation did not make this distinction. It used such a record as a covering NSEC for names below the cut, and as a direct match proving that other types did not exist at the cut. An attacker who can answer or modify DNS responses can replay the parent's genuine signed records to get an NXDOMAIN or NODATA response for an existing name in the child zone accepted as secure. A recursor caches that denial for the negative TTL.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix adds `NSEC::is_ancestor_delegation()` in hickory-proto. Validation no longer uses such a record to cover a name below its owner, and treats a direct match on it as bogus unless the query is for DS. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0539.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0539.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/2e3c829ea45000b1c409a64a03bd422618372471"}],"database_specific":{"license":"CC0-1.0"}} |