A vulnerability in Hickory DNS components hickory-proto (versions 0.25.0 through 0.26.0-alpha.1) and hickory-net (versions before 0.26.2) causes incorrect relational operator logic in the NSEC3 record handling. This flaw allows the last NSEC3 record in a zone's hash ring to incorrectly cover every hash except its owner. An attacker capable of injecting DNS responses can exploit this to replay the NSEC3 record and its RRSIG, forging DNSSEC-validated negative responses that deny legitimate domain names.
Hickory DNS versions hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 have a logic bug in the DS-fetch path of DnssecDnsHandle. This bug causes transient DS lookup errors such as SERVFAIL, REFUSED, or timeouts to be cached as Bogus DNSSEC validation verdicts. As a result, the validator returns SERVFAIL for all names under the affected child zone until the cache entry's TTL expires.
Hickory DNS versions hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 improperly compare DNSKEY public keys against DNSSEC trust anchors without verifying the DNSKEY record name. This flaw allows an attacker who can spoof or control DNS responses to replace a secure zone's DNSKEY RRset with the root zone's keys and use a large TTL to keep the malicious keys cached.
Hickory DNS versions hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 have an NSEC validation flaw. This flaw causes the software to incorrectly return a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually indicates the name exists as an empty non-terminal. On-path attackers can exploit this to change a genuine signed NODATA response's unsigned rcode from NOERROR to NXDOMAIN, leading validators to accept a forged nonexistence of the queried name.
Hickory DNS versions hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 improperly accept NSEC and NSEC3 DNSSEC nonexistence proofs when other records with the same owner name validate correctly. This allows attackers who can supply DNS responses to mix valid signed records with bogus NSEC or NSEC3 records of different types in the authority section, potentially forging nonexistence proofs.
Hickory DNS versions hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 do not properly verify, according to RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the existence of the delegation's NS record. This flaw allows attackers to reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.
Hickory DNS components hickory-net versions before 0.26.2 and hickory-proto versions 0.25.0 through 0.25.2 have a vulnerability where UDP DNS responses with an empty question section (QDCOUNT=0) bypass validation checks. This allows remote attackers who can inject spoofed UDP responses to circumvent question section matching and case-randomization checks, weakening DNS spoofing defenses.
A vulnerability in the DNS wire-format message parser of hickory-proto (Hickory DNS) versions 0.18 up to but not including 0.26.2 allows remote attackers to cause excessive memory allocation. The parser preallocates record vectors based on untrusted header fields (ANCOUNT, NSCOUNT, ARCOUNT), which can be set to 65535 by an attacker, leading to about 18MB of memory allocation per message. This can result in a denial of service due to resource exhaustion.
A vulnerability in the zone file parser of the hickory-proto crate in Hickory DNS versions 0.24.0 up to but not including 0.26.2 causes the parser to panic when processing a single token of 4096 bytes or longer. This can be exploited by attackers supplying crafted zone files to trigger a denial of service.
The hickory-proto library versions from 0.3.1 up to but not including 0.26.1 contain a vulnerability in the BinEncoder's name compression logic. This vulnerability arises because the encoder stores candidate labels for name compression in a vector and performs a linear scan to find matches, resulting in O(n²) complexity. An attacker can exploit this by crafting messages with many records, causing excessive CPU usage and potential denial-of-service (DoS). A fix is available in version 0.26.1.
A vulnerability in hickory-proto and hickory-net affects the NSEC3 closest-encloser proof validation process. When validating DNSSEC responses with a mismatched SOA owner in the authority section, the code enters an unbounded loop, causing memory exhaustion in release builds or a panic in debug builds. This can be triggered by specially crafted DNS responses involving NoData or NXDomain with cross-zone SOA records. The issue is fixed in hickory-net version 0.26.1.
A vulnerability in hickory-proto's BinEncoder causes CPU exhaustion during message encoding due to an O(n²) complexity in name compression. The encoder stores candidate labels in a vector and performs linear scans to find matches, which can be exploited by malicious messages with many records to cause denial-of-service (DoS) via CPU exhaustion. The issue is fixed in version 0.26.1.
A vulnerability in the Hickory proto library's DNSSEC validation logic causes an unbounded loop when validating certain DNS responses with mismatched SOA records. This can lead to a denial-of-service via memory exhaustion in release builds or a panic in debug builds. The issue affects versions from 0.25.0-alpha.3 up to but not including 0.26.0-beta.1 and is fixed in 0.26.0-beta.1.