Threats tagged 'ghsa-f6qc-6m8j-6hgc'

Hickory DNS versions hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 improperly accept NSEC and NSEC3 DNSSEC nonexistence proofs when other records with the same owner name validate correctly. This allows attackers who can supply DNS responses to mix valid signed records with bogus NSEC or NSEC3 records of different types in the authority section, potentially forging nonexistence proofs.