{"id":"CVE-2026-123607","aliases":["GHSA-3v94-mw7p-v465","RUSTSEC-2026-0118","RUSTSEC-2026-0120"],"title":"hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses","titleSource":"OSV","descriptionSource":"OSV","description":"The NSEC3 closest-encloser proof validation in `hickory-proto`'s\n`DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a\nlist of candidate encloser names. The iterator used assumes the\nQNAME is a descendant of the SOA owner, terminating only when the current\ncandidate equals the SOA name. When the SOA in a response's authority section\nis not an ancestor of the QNAME, the loop stalls at the DNS root and never\nterminates, repeatedly calling `Name::base_name()` and pushing newly allocated\n`Name` and hashed-name entries into the candidate `Vec`.\n\nThe bug is reachable by any caller of `DnssecDnsHandle` — including the\nresolver, recursor, and client — when built with the `dnssec-ring` or\n`dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is\ntriggered while validating a NoData or NXDomain response whose authority\nsection contains an SOA record from a zone other than an ancestor of the\nQNAME, on a code path that requires NSEC3 closest-encloser proof. In practice\nthis can be reached through an insecure CNAME chain that crosses zone\nboundaries into a DNSSEC-signed zone returning NoData, but the minimum\ncondition is just a mismatched SOA owner on a response requiring NSEC3\nvalidation.\n\nA `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds\nabort with a panic on the first iteration past the root. Release builds\ncompile the assertion out and run the loop unbounded, allocating until the\nprocess exhausts available memory (OOM). A reachable upstream attacker who\ncan return such a response can therefore crash a debug-built validator or\nexhaust memory on a release-built one.\n\nThe affected code was migrated from `hickory-proto` to `hickory-net` as part of\nthe 0.26.0 release. The `hickory-proto` 0.26.x release no longer offers\n`DnssecDnsHandle` and so we recommend all affected users update to `hickory-net`\n0.26.1 when the implementation of that type is required.","severity":"high","score":8.7,"published":"2026-05-01T12:00:00.000Z","modified":"2026-11-13T03:11:42.671Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"crates.io","name":"hickory-proto","sources":[{"name":"OSV · GHSA-3v94-mw7p-v465","url":"https://osv.dev/vulnerability/GHSA-3v94-mw7p-v465"}],"ranges":[{"events":[{"introduced":"0.25.0-alpha.3"},{"last_affected":"0.25.2"}],"type":"SEMVER"}],"versions":[],"fixed":[]},{"ecosystem":"crates.io","name":"hickory-net","sources":[{"name":"OSV · GHSA-3v94-mw7p-v465","url":"https://osv.dev/vulnerability/GHSA-3v94-mw7p-v465"}],"ranges":[{"events":[{"introduced":"0.26.0-alpha.1"},{"fixed":"0.26.1"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.1"]},{"ecosystem":"crates.io","name":"hickory-proto","sources":[{"name":"OSV · RUSTSEC-2026-0118","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0118"}],"ranges":[{"events":[{"introduced":"0.25.0-alpha.3"},{"fixed":"0.26.0-beta.1"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.0-beta.1"]},{"ecosystem":"crates.io","name":"hickory-net","sources":[{"name":"OSV · RUSTSEC-2026-0120","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0120"}],"ranges":[{"events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.1"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.1"]}],"sourceAffected":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465","https://github.com/hickory-dns/hickory-dns","https://rustsec.org/advisories/RUSTSEC-2026-0118.html","https://rustsec.org/advisories/RUSTSEC-2026-0120.html","https://crates.io/crates/hickory-proto","https://github.com/hickory-dns/hickory-dns/pull/3597","https://crates.io/crates/hickory-net","https://www.vulncheck.com/advisories/hickory-dns-nsec3-closest-encloser-proof-unbounded-loop-denial-of-service"],"sources":[{"name":"OSV","id":"GHSA-3v94-mw7p-v465","modified":"2026-11-08T10:55:55.393700581Z","url":"https://osv.dev/vulnerability/GHSA-3v94-mw7p-v465"},{"name":"OSV","id":"RUSTSEC-2026-0118","modified":"2026-11-09T09:21:20Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0118"},{"name":"OSV","id":"RUSTSEC-2026-0120","modified":"2026-11-09T09:21:20Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0120"},{"name":"CVE","id":"CVE-2026-123607","modified":"2026-11-13T03:11:42.671Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123607"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"cve":{"records":[{"id":"CVE-2026-123607","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T01:02:39.794Z","published":"2026-11-08T01:38:33.416Z","modified":"2026-11-13T03:11:42.671Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:33.416Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T03:11:42.671Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-nsec3-closest-encloser-proof-unbounded-loop-denial-of-service","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-835","description":"Loop with Unreachable Exit Condition ('Infinite Loop')","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T03:11:32.756799Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.25.0-alpha.3","status":"affected","lessThanOrEqual":"0.25.2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-proto","packageIdentity":{"ecosystem":"crates.io","name":"hickory-proto"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123607"},{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.26.0-alpha.1","status":"affected","lessThan":"0.26.1","versionType":"semver"},{"version":"0.26.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-net","packageIdentity":{"ecosystem":"crates.io","name":"hickory-net"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123607"}],"remediation":[],"observedAt":"2026-11-13T07:16:31.110Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-08T02:00:37.175Z","attemptedAt":"2026-11-08T02:00:37.175Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:00:32.378Z","attemptedAt":"2026-11-08T02:00:32.378Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:00:32.309Z","attemptedAt":"2026-11-08T02:00:32.309Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:00:32.736Z","attemptedAt":"2026-11-08T02:00:32.736Z"}],"evidence":[],"aiSummary":null}