{"id":"RUSTSEC-2026-0120","aliases":["GHSA-3v94-mw7p-v465","RUSTSEC-2026-0118"],"title":"NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses","summary":"NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses","severity":"none","vendor":"hickory-net","product":"hickory-net","ecosystem":"rust","affected":["hickory-net >= 0.0.0-0, < 0.26.1"],"patched":["hickory-net 0.26.1"],"published":"2026-05-01","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:09.238308824Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0120","references":[{"url":"https://crates.io/crates/hickory-net"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0120.html"},{"url":"https://github.com/hickory-dns/hickory-dns/pull/3597"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.191Z","slug":"RUSTSEC-2026-0120","body":"## Overview\n\nThe NSEC3 closest-encloser proof validation in `hickory-net`'s\n`DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a\nlist of candidate encloser names. The iterator used assumes the\nQNAME is a descendant of the SOA owner, terminating only when the current\ncandidate equals the SOA name. When the SOA in a response's authority section\nis not an ancestor of the QNAME, the loop stalls at the DNS root and never\nterminates, repeatedly calling `Name::base_name()` and pushing newly allocated\n`Name` and hashed-name entries into the candidate `Vec`.\n\nThe bug is reachable by any caller of `DnssecDnsHandle` — including the\nresolver, recursor, and client — when built with the `dnssec-ring` or\n`dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is\ntriggered while validating a NoData or NXDomain response whose authority\nsection contains an SOA record from a zone other than an ancestor of the\nQNAME, on a code path that requires NSEC3 closest-encloser proof. In practice\nthis can be reached through an insecure CNAME chain that crosses zone\nboundaries into a DNSSEC-signed zone returning NoData, but the minimum\ncondition is just a mismatched SOA owner on a response requiring NSEC3\nvalidation.\n\nA `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds\nabort with a panic on the first iteration past the root. Release builds\ncompile the assertion out and run the loop unbounded, allocating until the\nprocess exhausts available memory (OOM). A reachable upstream attacker who\ncan return such a response can therefore crash a debug-built validator or\nexhaust memory on a release-built one.\n\nWe recommend all affected users update to `hickory-net` 0.26.1 for the fix.\n\n## Affected packages\n\n- `hickory-net >= 0.0.0-0, < 0.26.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `hickory-net 0.26.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}