This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.
This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.
Resolved advisories:
- GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone
- GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records
- GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN
- GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence
- GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records
- GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3
- GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut
- GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut
- GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks
- GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion
- GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names
- GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists
- GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses
- GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
- GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer
- GHSA-j2rc-wxwh-62g9:
TrustAnchorsdoes not check name of DNSKEY - GHSA-rx82-4p2j-j5cv:
Name::hashdiscards label boundaries;ValidationCacheKey(u64)reuses the digest inEqimplementation, leaking an Insecure DNSSEC verdict across distinct owner names - GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries
- GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled
- GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS
- GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS
- GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines
- GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section
- GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses
- GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in
NameServerPool::try_send(resource-exhaustion DoS) - GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor
- GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget
- GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses
- GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing
- GHSA-2f4m-fq7w-mrgx: Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies
- GHSA-g8wg-4mwh-fjfv: DoQ server has no timeout when reading request
- GHSA-5r56-v84h-c3w5: DoH request body is buffered without a size limit
- GHSA-6f2x-v7q7-m7m5: Resolver follows irrelevant CNAME records
- GHSA-xv7c-h5g9-x25x: transient DS-fetch error inappropriately cached as BOGUS
- GHSA-9px7-7m25-f6q2: Recursive resolver: Empty connection pool is cached after failed IP lookup
- GHSA-29q9-p769-j8gq: Bogus answers cached for the attacker-supplied record TTL
- GHSA-4jwp-xjwm-333g: Missing IPv4-Mapped IPv6 address canonicalization
Special thanks go out to @qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @ATinyShoe, @kirk-baird, @thesmartshadow, @BeaCox, @jpds, @N0zoM1z0, and @JasonPap for reporting vulnerabilities as well.
If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @djc for commercial support.
What's Changed
- Reintroduce LookupIp into_iter by @tisonkun in #3639
- fix(resolver): thread bind_addr through TLS and HTTPS connections (backport to 0.26) by @kakarot-dev in #3654
- Raise minimum versions of dependencies by @divergentdave in #3661
- Canonicalize addresses consistently - 0.26 backport by @divergentdave in #3687
- fix: apply per-request timeout for DoH, DoQ, and DoH3 (0.26 backport) by @dsundquist in #3686
- fix(proto): verify RSASHA1-NSEC3-SHA1 (alg 7) with the same crypto as RSASHA1 (0.26 backport) by @edevil in #3693
- Add simple constructor for ResolverConfig by @divergentdave in #3710
- resolver: reconnect once when a reused pooled connection was closed (backport to 0.26) by @cf-rhett in #3719
- Update quinn-proto - backport by @divergentdave in #3748
- server: return NXDOMAIN for SOA queries on non-existent names (backport to 0.26) by @eyupcanakman in #3724
- Remove recursion from domain::name::read_inner (backport to 0.26) by @aochagavia in #3752
- Update anyhow to 1.0.103 - backport by @divergentdave in #3761
- add drop_privileges config option to skip privilege dropping - backport by @Webrowse in #3763
- Server: copy the DO bit of the query in the response (backport to 0.26) by @aochagavia in #3766
- tests: fix Ed25519 key encoding (0.26 backport) by @djc in #3772
- Update crossbeam-epoch - backport by @divergentdave in #3777
- Fix Clippy lints - backport by @divergentdave in #3780
- fix(server): backport CNAME answer section fix to 0.26 by @mortn in #3783
- backport r0.26: Fix DS::from_key not using DNSKEY RDATA by @AlveElde in #3787
- release/0.26 backport: Include CNAME records when calculating minimum TTL for caching purposes by @sejoker in #3794
- resolver: parse packed system search domains (backport to 0.26) by @cf-rhett in #3803
- bin: better error when a store type needs a disabled Cargo feature by @Webrowse in #3810
- release/0.26 backport: recursor: add config for qname minimization with relaxed mode. by @avnyu in #3809
- resolver: Export per-connection query metrics (backport to 0.26) by @pdelong in #3821
- backport r0.26: Limit non-EDNS UDP responses to 512 by @AlveElde in #3825
- proto: Implement size_hint for RecordSet iterators (backport to 0.26) by @WinterCore in #3826
- Update h2 to 0.4.16 - backport by @divergentdave in #3840
- Fix CI on release/0.26 branch by @divergentdave in #3862
- Allow absolute blocklist paths (0.26 backport) by @liff in #3864
- Security fixes (release/0.26, part 1) by @divergentdave in #3870
- Security fixes (release/0.26, part 2) by @divergentdave in #3871
New Contributors
- @dsundquist made their first contribution in #3686
- @sejoker made their first contribution in #3794
Full Changelog: v0.26.1...v0.26.2