# GHSA-3v94-mw7p-v465: hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses > A remote attacker can cause a denial of service by sending crafted DNS responses that trigger an infinite loop in DNSSEC validation, exhausting memory. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 1 May 2026 - **Also known as:** RUSTSEC-2026-0118, RUSTSEC-2026-0120 ## What is GHSA-3v94-mw7p-v465? GHSA-3v94-mw7p-v465 is a denial of service vulnerability in hickory-net, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description The NSEC3 closest-encloser proof validation in `hickory-proto`'s (0.25.0-alpha.3 ... 0.25.2) and `hickory-net`'s (0.26.0-alpha.1 .. 0.26.0) `DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the SOA name. When the SOA in a response's authority section is not an ancestor of the QNAME, the loop stalls at the DNS root and never terminates, repeatedly calling `Name::base_name()` and pushing newly allocated `Name` and hashed-name entries into the candidate `Vec`. The bug is reachable by any caller of `DnssecDnsHandle`, including the resolver, recursor, and client, when built with the `dnssec-ring` or `dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is triggered while validating a NoData or NXDomain response whose authority section contains an SOA record from a zone other than an ancestor of the QNAME, on a code path that requires NSEC3 closest-encloser proof. In practice this can be reached through an insecure CNAME chain that crosses zone boundaries into a DNSSEC-signed zone returning NoData, but the minimum condition is just a mismatched SOA owner on a response requiring NSEC3 validation. A `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds abort with a panic on the first iteration past the root. Release builds compile the assertion out and run the loop unbounded, allocating until the process exhausts available memory. A reachable upstream attacker who can return such a response can therefore crash a debug build or exhaust memory on a release build, for the affected configurations. The affected code was migrated from `hickory-proto` to `hickory-net` as part of the 0.26.0 release. Hickory DNS recommends that all affected users update to `hickory-net` 0.26.1 for the fix. ### Reporter David Cook, ISRG ## Which versions are affected by GHSA-3v94-mw7p-v465? 6 open source packages ship an affected version, including hickory-net and hickory-proto. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `hickory-net` | crates.io | From 0.0.0-0 | 0.26.1 | | `hickory-net` | crates.io | From 0.26.0-alpha.1 | 0.26.1 | | `hickory-net` | crates.io | From 0.26.0-alpha.1 | 0.26.1 | | `hickory-proto` | crates.io | From 0.25.0-alpha.3 to 0.25.2 | None | | `hickory-proto` | crates.io | From 0.25.0-alpha.3 to 0.25.2 | None | | `hickory-proto` | crates.io | From 0.25.0-alpha.3 | 0.26.0-beta.1 | ## How do I fix GHSA-3v94-mw7p-v465? Upgrade hickory-net to 0.26.1 or later. ## Is GHSA-3v94-mw7p-v465 being exploited? There is no known exploitation of GHSA-3v94-mw7p-v465 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-3v94-mw7p-v465 and fix it if it is affected. What it is: GHSA-3v94-mw7p-v465 is a denial of service vulnerability in hickory-net, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-3v94-mw7p-v465 in the wild and no public exploit code. Affected packages and fixed versions: - hickory-net (crates.io): affected from 0.0.0-0; fixed in 0.26.1 - hickory-net (crates.io): affected from 0.26.0-alpha.1; fixed in 0.26.1 - hickory-net (crates.io): affected from 0.26.0-alpha.1; fixed in 0.26.1 - hickory-proto (crates.io): affected from 0.25.0-alpha.3 up to 0.25.2; no fix listed - hickory-proto (crates.io): affected from 0.25.0-alpha.3 up to 0.25.2; no fix listed - hickory-proto (crates.io): affected from 0.25.0-alpha.3; fixed in 0.26.0-beta.1 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-3v94-mw7p-v465/ (Markdown: https://insights.sbomify.com/GHSA-3v94-mw7p-v465/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-3v94-mw7p-v465 --- From sbomify Insights: https://insights.sbomify.com/GHSA-3v94-mw7p-v465/ Summaries are generated and may contain mistakes; the official description above is the record.