A vulnerability in hickory-proto versions 0.25.0 through 0.26.0-alpha.1 allows DNSSEC validation to incorrectly accept a parent zone's NSEC3 record at a zone cut as proof of nonexistence for names in the child zone. This can lead to denial of existence for valid child zone names if an attacker can replay or modify DNS responses. The issue was fixed in hickory-net 0.26.2, with no fix in hickory-proto releases. Users should upgrade to hickory-net 0.26.2 or later to mitigate this issue.