Threats tagged 'ghsa-fg2p-gxqh-hm83'

Hickory DNS versions hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 have an NSEC validation flaw. This flaw causes the software to incorrectly return a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually indicates the name exists as an empty non-terminal. On-path attackers can exploit this to change a genuine signed NODATA response's unsigned rcode from NOERROR to NXDOMAIN, leading validators to accept a forged nonexistence of the queried name.