{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.25.0-alpha.3","last_affected":"0.25.2"}],"component":"hickory-proto","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-3v94-mw7p-v465","id":"tcs_01M5KES2VGWF5SMTWRVXDAEDP0","modified_at":"2026-09-10T03:50:45.304576252Z","published_at":"2026-05-07T02:59:20Z","references":["https://osv.dev/vulnerability/GHSA-3v94-mw7p-v465","https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465","https://github.com/hickory-dns/hickory-dns","https://rustsec.org/advisories/RUSTSEC-2026-0118.html","https://rustsec.org/advisories/RUSTSEC-2026-0120.html"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-3v94-mw7p-v465","url":"https://osv.dev/vulnerability/GHSA-3v94-mw7p-v465"}],"summary":"hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses"}