{"answers":{"affected":"6 open source packages ship an affected version, including hickory-net and hickory-proto.","exploited":"There is no known exploitation of GHSA-3v94-mw7p-v465 in the wild and no public exploit code.","fix":"Upgrade hickory-net to 0.26.1 or later.","what":"GHSA-3v94-mw7p-v465 is a denial of service vulnerability in hickory-net, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-3v94-mw7p-v465 and fix it if it is affected.\n\nWhat it is: GHSA-3v94-mw7p-v465 is a denial of service vulnerability in hickory-net, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-3v94-mw7p-v465 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- hickory-net (crates.io): affected from 0.0.0-0; fixed in 0.26.1\n- hickory-net (crates.io): affected from 0.26.0-alpha.1; fixed in 0.26.1\n- hickory-net (crates.io): affected from 0.26.0-alpha.1; fixed in 0.26.1\n- hickory-proto (crates.io): affected from 0.25.0-alpha.3 up to 0.25.2; no fix listed\n- hickory-proto (crates.io): affected from 0.25.0-alpha.3 up to 0.25.2; no fix listed\n- hickory-proto (crates.io): affected from 0.25.0-alpha.3; fixed in 0.26.0-beta.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-3v94-mw7p-v465/ (Markdown: https://insights.sbomify.com/GHSA-3v94-mw7p-v465/index.md)","id":"GHSA-3v94-mw7p-v465","markdown":"https://insights.sbomify.com/GHSA-3v94-mw7p-v465/index.md","name":"GHSA-3v94-mw7p-v465","record":{"aliases":["RUSTSEC-2026-0118","RUSTSEC-2026-0120"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Rust DNS library","requires_auth":"none","summary":"A remote attacker can cause a denial of service by sending crafted DNS responses that trigger an infinite loop in DNSSEC validation, exhausting memory.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The NSEC3 closest-encloser proof validation in `hickory-proto`'s (0.25.0-alpha.3 ... 0.25.2) and `hickory-net`'s (0.26.0-alpha.1 .. 0.26.0)  `DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the SOA name. When the SOA in a response's authority section is not an ancestor of the QNAME, the loop stalls at the DNS root and never terminates, repeatedly calling `Name::base_name()` and pushing newly allocated `Name` and hashed-name entries into the candidate `Vec`.\n\nThe bug is reachable by any caller of `DnssecDnsHandle`, including the resolver, recursor, and client, when built with the `dnssec-ring` or `dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is triggered while validating a NoData or NXDomain response whose authority section contains an SOA record from a zone other than an ancestor of the QNAME, on a code path that requires NSEC3 closest-encloser proof. In practice this can be reached through an insecure CNAME chain that crosses zone boundaries into a DNSSEC-signed zone returning NoData, but the minimum condition is just a mismatched SOA owner on a response requiring NSEC3 validation.\n\nA `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds abort with a panic on the first iteration past the root. Release builds compile the assertion out and run the loop unbounded, allocating until the process exhausts available memory. A reachable upstream attacker who can return such a response can therefore crash a debug build or exhaust memory on a release build, for the affected configurations.\n\nThe affected code was migrated from `hickory-proto` to `hickory-net` as part of the 0.26.0 release. Hickory DNS recommends that all affected users update to `hickory-net` 0.26.1 for the fix.\n\n### Reporter\n\nDavid Cook, ISRG","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses","id":"GHSA-3v94-mw7p-v465","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":6,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.26.1"],"introduced":["0.0.0-0"],"last_affected":[],"package":"hickory-net","purl":"pkg:cargo/hickory-net","source":"RUSTSEC-2026-0120"},{"ecosystem":"crates.io","fixed":["0.26.1"],"introduced":["0.26.0-alpha.1"],"last_affected":[],"package":"hickory-net","purl":null,"source":"GHSA-3v94-mw7p-v465"},{"ecosystem":"crates.io","fixed":["0.26.1"],"introduced":["0.26.0-alpha.1"],"last_affected":[],"package":"hickory-net","purl":"pkg:cargo/hickory-net","source":"GHSA-3v94-mw7p-v465"},{"ecosystem":"crates.io","fixed":[],"introduced":["0.25.0-alpha.3"],"last_affected":["0.25.2"],"package":"hickory-proto","purl":null,"source":"GHSA-3v94-mw7p-v465"},{"ecosystem":"crates.io","fixed":[],"introduced":["0.25.0-alpha.3"],"last_affected":["0.25.2"],"package":"hickory-proto","purl":"pkg:cargo/hickory-proto","source":"GHSA-3v94-mw7p-v465"},{"ecosystem":"crates.io","fixed":["0.26.0-beta.1"],"introduced":["0.25.0-alpha.3"],"last_affected":[],"package":"hickory-proto","purl":"pkg:cargo/hickory-proto","source":"RUSTSEC-2026-0118"}],"products":null,"published":"2026-05-01","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A remote attacker can cause a denial of service by sending crafted DNS responses that trigger an infinite loop in DNSSEC validation, exhausting memory.","url":"https://insights.sbomify.com/GHSA-3v94-mw7p-v465/"}