Threats tagged 'ghsa-hj9x-wc4q-vmw3'

A vulnerability in Hickory DNS components hickory-proto (versions 0.25.0 through 0.26.0-alpha.1) and hickory-net (versions before 0.26.2) causes incorrect relational operator logic in the NSEC3 record handling. This flaw allows the last NSEC3 record in a zone's hash ring to incorrectly cover every hash except its owner. An attacker capable of injecting DNS responses can exploit this to replay the NSEC3 record and its RRSIG, forging DNSSEC-validated negative responses that deny legitimate domain names.