{"id":"RUSTSEC-2026-0488","summary":"Integer underflow when reporting a malformed TSIG record","details":"When a TSIG record is decoded from the DNS wire format, its MAC length and \"other data\" length are checked against the end of the record data. If a check failed, the error value was built from `end_idx - decoder.index()`. For a malformed record the decoder can already be past `end_idx`, so this unsigned subtraction underflows.\n\nIn builds with overflow checks enabled (the `dev` profile by default) the underflow panics, so a peer that sends a crafted TSIG record can crash the process. In builds without overflow checks the result wraps and is only used in the returned error.\n\nThe fix returns a plain \"insufficient bytes\" error without the subtraction. It is in 0.26.2.","aliases":["GHSA-x962-5xwx-fr8x"],"modified":"2026-11-11T12:30:02.896196450Z","published":"2026-09-03T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0488.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/b1246a8a21b6dcc34d427a7d39dd96e10825c384"}],"affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0488.json"}}],"schema_version":"1.9.2"}