Threats tagged 'ghsa-88cx-p9f5-pr4w'

Hickory DNS versions hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 have a DNSSEC validation flaw. The validating recursor's NSEC handler incorrectly accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. This flaw allows an attacker to forge an NXDOMAIN response using legitimately signed parent NSEC records, causing an authenticated denial of existing child-zone names cached for the negative TTL.