Threats tagged 'rustsec-2026-0539'

A vulnerability in hickory-net's DNSSEC validation allows an attacker who can modify DNS responses to replay parent zone NSEC records to cause a recursive resolver to accept a denial of existence (NXDOMAIN or NODATA) for valid names in a child zone. This occurs because the validation incorrectly treats parent-side NSEC records at a zone cut as proof of nonexistence below the cut, contrary to RFC 6840. The issue affects versions prior to 0.26.2 and is fixed in version 0.26.2.