A vulnerability in hickory-proto's DNSSEC validation prior to version 0.26.0-beta.1 allows an attacker controlling a DNS zone to use a signed NSEC3 record to incorrectly prove that a name does not exist in another zone. This occurs because the validation only matched the hashed first label of the NSEC3 owner name without verifying the rest of the owner name against the zone. The issue was fixed in hickory-net 0.26.2, which is used from hickory-proto 0.26.0-beta.1 onward.