Threats tagged 'ghsa-v96c-g4c4-84vh'

A DNSSEC validation flaw exists in Hickory DNS hickory-proto versions 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2. The flaw is in the validating recursor's NSEC3 handler, which incorrectly accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence by matching the closest encloser by hash alone without verifying the type bitmap. This can cause NXDOMAIN or NODATA responses to be cached with the AD flag set, resulting in denial of resolution for existing domain names at and below the zone cut.