Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record (hickory-proto)

Parent-side NSEC at a zone cut accepted as proof of nonexistence (hickory-proto)

Parent-side NSEC3 at a zone cut accepted as proof of nonexistence (hickory-proto 0.25)

Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record

Parent-side NSEC3 at a zone cut accepted as proof of nonexistence at and below the cut

Parent-side NSEC at a zone cut accepted as proof of nonexistence below the cut

Inverted NSEC3 comparison in DNSSEC validation (hickory-proto 0.25)

NSEC3 owner names not checked against the zone in DNSSEC validation (hickory-proto)

NXDOMAIN accepted for a proven empty non-terminal (hickory-proto)

DNSSEC validation accepted an unrelated signed RRset as the answer (hickory-proto)

Resolver::lookup and lookup_ip returned records that failed DNSSEC validation

Unbounded retries on truncated responses in the name server pool

Recursor followed every glueless name server in a referral, with no per-query budget

Recursor kept querying cyclic glueless sibling delegations

NXDOMAIN accepted for an empty non-terminal that the NSEC record proves exists

NSEC wraparound detection trusted an unvalidated SOA record

DNSSEC validation cache could reuse an Insecure result for a different name

NSEC3 records from another zone were accepted in proofs of nonexistence

Inverted NSEC3 comparison lets one record "prove" that almost any name does not exist

RRSIG signer name was not checked against the zone of the signed records

DNSSEC validation accepted a validly signed but unrelated RRset as the answer

Spoofed malformed UDP datagrams abort DNS lookups

Recursor followed every glueless name server in a referral (no fixed hickory-recursor release)

Recursor kept querying cyclic glueless sibling delegations (no fixed hickory-recursor release)

Zone file lexer panics on a token of 4096 or more characters

Memory amplification from record counts in the DNS message header

Panic when an SVCB or HTTPS parameter value is a single quote character

Panic on a malformed alpn value when parsing SVCB or HTTPS records from text

Integer underflow when reporting a malformed TSIG record

NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

CPU exhaustion during message encoding due to O(n²) name compression

NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

Record cache accepts AUTHORITY section NS from sibling zone via parent-pool zone-context elevation