{"schemaVersion":3,"id":"GHSA-3V94-MW7P-V465","aliases":["RUSTSEC-2026-0118","RUSTSEC-2026-0120"],"status":"published","duplicateOf":null,"title":null,"description":"NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses\n\nThe NSEC3 closest-encloser proof validation in `hickory-net`'s\n`DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a\nlist of candidate encloser names. The iterator used assumes the\nQNAME is a descendant of the SOA owner, terminating only when the current\ncandidate equals the SOA name. When the SOA in a response's authority section\nis not an ancestor of the QNAME, the loop stalls at the DNS root and never\nterminates, repeatedly calling `Name::base_name()` and pushing newly allocated\n`Name` and hashed-name entries into the candidate `Vec`.\n\nThe bug is reachable by any caller of `DnssecDnsHandle` — including the\nresolver, recursor, and client — when built with the `dnssec-ring` or\n`dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is\ntriggered while validating a NoData or NXDomain response whose authority\nsection contains an SOA record from a zone other than an ancestor of the\nQNAME, on a code path that requires NSEC3 closest-encloser proof. In practice\nthis can be reached through an insecure CNAME chain that crosses zone\nboundaries into a DNSSEC-signed zone returning NoData, but the minimum\ncondition is just a mismatched SOA owner on a response requiring NSEC3\nvalidation.\n\nA `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds\nabort with a panic on the first iteration past the root. Release builds\ncompile the assertion out and run the loop unbounded, allocating until the\nprocess exhausts available memory (OOM). A reachable upstream attacker who\ncan return such a response can therefore crash a debug-built validator or\nexhaust memory on a release-built one.\n\nWe recommend all affected users update to `hickory-net` 0.26.1 for the fix.","dates":{"published":"2026-05-01T12:00:00.000Z","modified":"2026-10-12T18:00:09.238Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.7,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"OSV · Crates.io","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","computed":true,"selection":"version-preference"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"OSV · Crates.io","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"Crates.Io","product":"hickory-net","name":"hickory-net","label":"hickory-net","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/hickory-net","purlType":"cargo","versions":[{"text":"≥ 0.26.0-alpha.1, < 0.26.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.0.0-0, < 0.26.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.26.0-alpha.1, < 0.26.1 | ≥ 0.0.0-0, < 0.26.1","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"hickory-proto","name":"hickory-proto","label":"hickory-proto","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/hickory-proto","purlType":"cargo","versions":[{"text":"≥ 0.25.0-alpha.3, ≤ 0.25.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.25.0-alpha.3, < 0.26.0-beta.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.25.0-alpha.3, ≤ 0.25.2 | ≥ 0.25.0-alpha.3, < 0.26.0-beta.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465","label":"github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/hickory-dns/hickory-dns","label":"github.com/hickory-dns/hickory-dns","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0118.html","label":"rustsec.org/advisories/RUSTSEC-2026-0118.html","hostname":"rustsec.org","tags":["WEB","Advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0120.html","label":"rustsec.org/advisories/RUSTSEC-2026-0120.html","hostname":"rustsec.org","tags":["WEB","Advisory"]},{"url":"https://crates.io/crates/hickory-proto","label":"crates.io/crates/hickory-proto","hostname":"crates.io","tags":["PACKAGE"]},{"url":"https://github.com/hickory-dns/hickory-dns/pull/3597","label":"github.com/hickory-dns/hickory-dns/pull/3597","hostname":"github.com","tags":["WEB"]},{"url":"https://crates.io/crates/hickory-net","label":"crates.io/crates/hickory-net","hostname":"crates.io","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["CGA-23QX-FP7V-QW44","CGA-243F-H9J4-522F","CGA-296X-46RX-3467","CGA-3969-5P9R-278H","CGA-449R-468J-P7FJ","CGA-48QR-95WQ-VWW4","CGA-54GW-JP2F-HQRR","CGA-5GX4-8X92-QJ4R","CGA-5MMJ-MFJV-M735","CGA-624W-XM3J-XJ3W","CGA-63M3-WHWW-58C3","CGA-66J9-HRP3-4284","CGA-6GW5-C75F-J638","CGA-6MPP-J5J4-XQQC","CGA-6QP9-W3HV-JGRJ","CGA-725J-X84R-JF77","CGA-7FXV-W8H2-8C6V","CGA-8MP4-4RFQ-3V7G","CGA-945P-Q2VM-8R4G","CGA-CH4V-P2HQ-QM79","CGA-F6R5-6C3X-6MWP","CGA-FF24-MF94-WJ8G","CGA-FHC4-8MXM-R8FW","CGA-H474-2CVW-FXG7","CGA-HCPF-Q5FG-7CW4","CGA-HM2R-43WR-RP27","CGA-HQG2-3FF8-HPXX","CGA-HR5M-9WM9-VQW2","CGA-J93G-8F43-PRCR","CGA-JPPG-W927-RV34","CGA-JQHC-H9W9-4WC6","CGA-JX58-GH73-JGH8","CGA-JXPW-MV69-HM83","CGA-M4M3-42Q4-J5RM","CGA-M7QP-H44M-57VF","CGA-MMG5-MX5R-MHRP","CGA-MPQX-VX3V-FCW8","CGA-PX59-4W8X-G6J4","CGA-Q6W9-QWG8-WJ96","CGA-R6M2-83VM-PF39","CGA-R74V-G9MQ-78M3","CGA-R995-6JH8-QWGV","CGA-V746-J6WP-F7H9","CGA-VVCR-453G-F2JR","CGA-W5H2-F7W9-RQWM","CGA-X3RR-QPJV-4MGW","CGA-XJC8-7GVJ-R64Q","CGA-XPMJ-MR3V-37WW"],"duplicates":[],"related":["CGA-37H6-GM7X-242M"]},"timeline":[{"kind":"published","date":"2026-05-01T12:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-12T18:00:09.238Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T21:45:49.306Z","stale":false,"partial":false}}