A vulnerability in hickory-proto versions before 0.26.0-beta.1 allows DNSSEC validation to incorrectly accept a child-side NSEC or NSEC3 record with the SOA bit set as proof that the parent zone lacks a DS record. This flaw could enable an attacker who can modify DNS responses to make a secure delegation appear insecure and forge records in the child zone. The issue was fixed by moving DNSSEC validation to the hickory-net crate, with the fix included starting in hickory-net 0.26.2. Users relying on older hickory-proto versions should upgrade to 0.26.0-beta.1 or later to mitigate this vulnerability.