Threats tagged 'ghsa-qjhc-4gx4-vvmf'

A DNSSEC validation flaw exists in Hickory DNS hickory-proto versions 0.25.0-alpha.3 through 0.25.2 and hickory-net versions 0.26.0-alpha.1 before 0.26.2. The flaw allows acceptance of NSEC3-signed NODATA responses for zone-apex queries as secure without a matching NSEC3 record for the hashed QNAME. This can enable on-path attackers or malicious authoritative servers to replay a validly signed non-apex NSEC3 with the zone's signed SOA, resulting in an authenticated denial of any apex RRtype for the negative-cache TTL.