{"id":"RUSTSEC-2026-0541","summary":"Parent-side NSEC3 at a zone cut accepted as proof of nonexistence at and below the cut","details":"At a delegation, the parent zone signs an NSEC3 record for the child's name whose type bitmap has NS but not SOA (or has DNAME). RFC 6840 section 4.1 and RFC 5155 section 8.3 say such a record only proves that no DS record exists at that name.\n\nNSEC3 validation picked the closest encloser by matching the hashed owner name alone, without looking at the type bitmap, so it accepted such a record as the closest encloser for names below the cut. For NODATA responses, it accepted a direct match on such a record as proof that any type other than the queried one and CNAME was absent, not only DS. An attacker who can answer or modify DNS responses can replay the parent's genuine signed records to get an NXDOMAIN for a name below the cut, or a NODATA for a non-DS type at the cut, accepted as secure. A recursor caches that denial for the negative TTL.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix adds `NSEC3::is_ancestor_delegation()` in hickory-proto. Validation no longer accepts such a record as a closest encloser, and treats a direct match on it as bogus unless the query is for DS. It is in 0.26.2.","aliases":["CVE-2026-123595","GHSA-624w-vvww-xvpw","RUSTSEC-2026-0532"],"modified":"2026-11-13T12:55:46.260287377Z","published":"2026-09-03T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0541.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/889801333d7f18d59a4468100e8cd1859e083d43"}],"affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0541.json"}}],"schema_version":"1.9.2"}