Threats tagged 'rustsec-2026-0512'

A vulnerability in hickory-proto up to version 0.26.0-alpha.1 causes DNSSEC validation to incorrectly accept a signed RRset from a DNS response even if it does not match the queried name and type. This allows an attacker who can modify DNS responses to provide a valid signed RRset for a different name or type, which is mistakenly accepted as a valid answer. The issue was fixed by moving DNSSEC validation to the hickory-net crate and correcting the validation logic in hickory-net 0.26.2. Users relying on DNSSEC validation in older hickory-proto versions should upgrade to 0.26.0-beta.1 or later where the fix is included.