{"id":"RUSTSEC-2026-0310","revision":null,"records":[{"revision":"2543dbe941cc489592eff2b72d0bf455","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0310","aliases":[],"title":"Various panics, soundness and resource exhaustion issues","description":"Version 0.12.3 fixes a large number of panics, soundness issues, and\nCPU and memory exhaustion issues in all parts of the crate.\n\nThe following is a summary of the issues per affected components.\nFor details, please see the [release\nnotes](https://github.com/NLnetLabs/domain/releases/tag/v0.12.3).\n\n## Base\n\n* Limited the number of compression pointers that are followed when parsing\n  a compressed name to 255 to avoid following really long chains.\n* Limited the length of CNAME chains followed by `Message::canonical_name`\n  to 20. This also fixed an integer overflow in this method when ANCOUNT\n  was`u16::MAX`.\n* Changed `QuestionSection::answer` to skip over all remaining questions\n  without parsing the QNAMEs to avoid being slowed down by malicious\n  names.\n* Added length checks when scanning and parsing variable length record\n  data types. This fixes issues with the message builder, which assumes that\n  record data is never too large for placing in a message.\n\n## Stub Resolver\n\n* Fixed possible panics in the resolver’s `FoundHosts::qname` and\n  `FoundHosts::canonical_name`.\n* Fixed various issues in SRV processing.\n\n## Zonefile parsing\n\n* Fixed soundness issues when reading UTF-8 and an integer overflow when\n  reading unsigned integers.\n* Fixed a panic when reading empty TXT records.\n\n## Client and server transports, DNSSEC signer and validator\n\nFixed various panics that could be triggered by malicious incoming DNS\nmessages.\n\n## Zonetree\n\nFixed various panics and a memory exhaustion issue when updating the zone.\n\n## Acknowledgements\n\nWe would like to thank Qifan Zhang, Palo Alto Networks,\nAntoni (Tony) Jagodka ([@DrVelvetFog](https://github.com/DrVelvetFog)),\nand [@SebastiaanYN](https://github.com/SebastiaanYN) for\nreporting issues fixed in this release.","state":0,"publishedAt":"2026-09-25T12:00:00+00:00","modifiedAt":"2026-09-25T18:00:04.4767157+00:00","affected":[{"ecosystem":"crates.io","name":"domain","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.12.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/domain","https://rustsec.org/advisories/RUSTSEC-2026-0310.html","https://github.com/NLnetLabs/domain/releases/tag/v0.12.3"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0310","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0310","identifiers":["RUSTSEC-2026-0310"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T09:55:31.2947259+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T09:55:31.2947259+00:00","lastSuccessAt":"2026-11-12T09:55:31.4790381+00:00","error":null,"lastVerifiedAt":"2026-11-12T09:55:31.4790388+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-597d2a846bb8b004ef04143ee27b4f2061367ce1f574db03c0eec66ce3f0654b","complete":true,"records":424644,"lastAttemptAt":"2026-11-12T10:53:33.7939567+00:00","lastSuccessAt":"2026-11-12T10:53:33.7645522+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:53:33.7939567+00:00","snapshotPublishedAt":"2026-11-12T10:28:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-9db698e4659747149ec1092e3d34a5a1","complete":true,"records":13764,"lastAttemptAt":"2026-11-12T09:56:01.66177+00:00","lastSuccessAt":"2026-11-12T09:56:01.656+00:00","error":null,"lastVerifiedAt":"2026-11-12T09:56:01.656+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13817,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T09:55:31.2947259+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T09:55:31.2947259+00:00","lastSuccessAt":"2026-11-12T09:55:31.4798179+00:00","error":null,"lastVerifiedAt":"2026-11-12T09:55:31.4798182+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1a7cc780d036453fb794b7d2d385de9d","complete":false,"records":13764,"lastAttemptAt":"2026-11-12T09:55:57.1306222+00:00","lastSuccessAt":"2026-11-12T09:55:57.111+00:00","error":null,"lastVerifiedAt":"2026-11-12T09:55:57.111+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13313,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T09:55:26.640208+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T09:55:26.640208+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T10:53:33.9269183+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:53:33.9269183+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f46f74c6a30a9b6e4cfb481719c6d35521ebec2d53ebf163223d093ae587eb9d","complete":true,"records":3106,"lastAttemptAt":"2026-11-12T09:55:31.2553322+00:00","lastSuccessAt":"2026-11-12T09:55:31.1176285+00:00","error":null,"lastVerifiedAt":"2026-11-12T09:55:31.2553322+00:00","snapshotPublishedAt":"2026-11-12T09:48:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ef2ecb421099c77d2be989a707f600817e68bbc84b134f8c0b574289c6a9dbb4","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T10:53:40.0952115+00:00","lastSuccessAt":"2026-11-12T09:55:25.0439596+00:00","error":null,"lastVerifiedAt":"2026-11-12T09:55:26.5140063+00:00","snapshotPublishedAt":"2026-11-12T09:33:09+00:00","importing":true,"stagedRecords":161500,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}