{"id":"RUSTSEC-2026-0118","aliases":["GHSA-3v94-mw7p-v465","RUSTSEC-2026-0120"],"title":"NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses","summary":"NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses","severity":"none","vendor":"hickory-proto","product":"hickory-proto","ecosystem":"rust","affected":["hickory-proto >= 0.25.0-alpha.3, < 0.26.0-beta.1"],"patched":["hickory-proto 0.26.0-beta.1"],"published":"2026-05-01","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:13.245565018Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0118","references":[{"url":"https://crates.io/crates/hickory-proto"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0118.html"},{"url":"https://github.com/hickory-dns/hickory-dns/pull/3597"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.191Z","slug":"RUSTSEC-2026-0118","body":"## Overview\n\nThe NSEC3 closest-encloser proof validation in `hickory-proto`'s\n`DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a\nlist of candidate encloser names. The iterator used assumes the\nQNAME is a descendant of the SOA owner, terminating only when the current\ncandidate equals the SOA name. When the SOA in a response's authority section\nis not an ancestor of the QNAME, the loop stalls at the DNS root and never\nterminates, repeatedly calling `Name::base_name()` and pushing newly allocated\n`Name` and hashed-name entries into the candidate `Vec`.\n\nThe bug is reachable by any caller of `DnssecDnsHandle` — including the\nresolver, recursor, and client — when built with the `dnssec-ring` or\n`dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is\ntriggered while validating a NoData or NXDomain response whose authority\nsection contains an SOA record from a zone other than an ancestor of the\nQNAME, on a code path that requires NSEC3 closest-encloser proof. In practice\nthis can be reached through an insecure CNAME chain that crosses zone\nboundaries into a DNSSEC-signed zone returning NoData, but the minimum\ncondition is just a mismatched SOA owner on a response requiring NSEC3\nvalidation.\n\nA `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds\nabort with a panic on the first iteration past the root. Release builds\ncompile the assertion out and run the loop unbounded, allocating until the\nprocess exhausts available memory (OOM). A reachable upstream attacker who\ncan return such a response can therefore crash a debug-built validator or\nexhaust memory on a release-built one.\n\nThe affected code was migrated from `hickory-proto` to `hickory-net` as part of\nthe 0.26.0 release. The `hickory-proto` 0.26.x release no longer offers\n`DnssecDnsHandle` and so we recommend all affected users update to `hickory-net`\n0.26.1 when the implementation of that type is required.\n\n## Affected packages\n\n- `hickory-proto >= 0.25.0-alpha.3, < 0.26.0-beta.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `hickory-proto 0.26.0-beta.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}