{"action":"Upgrade hickory-net to 0.26.1 or later.","affected":[{"fixed":"0.26.1","introduced":"0.26.0-alpha.1"}],"component":"hickory-net","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.26.1"],"ghsa_id":"GHSA-3v94-mw7p-v465","id":"tcs_01M5KES2ZRPJHXB1V7E12W2WG9","modified_at":"2026-09-10T03:50:45.304576252Z","published_at":"2026-05-07T02:59:20Z","references":["https://osv.dev/vulnerability/GHSA-3v94-mw7p-v465","https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465","https://github.com/hickory-dns/hickory-dns","https://rustsec.org/advisories/RUSTSEC-2026-0118.html","https://rustsec.org/advisories/RUSTSEC-2026-0120.html"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-3v94-mw7p-v465#crates.io/hickory-net","url":"https://osv.dev/vulnerability/GHSA-3v94-mw7p-v465"}],"summary":"hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses"}