Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record (hickory-proto)

Parent-side NSEC at a zone cut accepted as proof of nonexistence (hickory-proto)

Parent-side NSEC3 at a zone cut accepted as proof of nonexistence (hickory-proto 0.25)

Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record

Parent-side NSEC3 at a zone cut accepted as proof of nonexistence at and below the cut

Parent-side NSEC at a zone cut accepted as proof of nonexistence below the cut

Inverted NSEC3 comparison in DNSSEC validation (hickory-proto 0.25)

NSEC3 owner names not checked against the zone in DNSSEC validation (hickory-proto)

NXDOMAIN accepted for a proven empty non-terminal (hickory-proto)

DNSSEC validation accepted an unrelated signed RRset as the answer (hickory-proto)

Resolver::lookup and lookup_ip returned records that failed DNSSEC validation

NXDOMAIN accepted for an empty non-terminal that the NSEC record proves exists

NSEC wraparound detection trusted an unvalidated SOA record

DNSSEC validation cache could reuse an Insecure result for a different name

NSEC3 records from another zone were accepted in proofs of nonexistence

Inverted NSEC3 comparison lets one record "prove" that almost any name does not exist

RRSIG signer name was not checked against the zone of the signed records

DNSSEC validation accepted a validly signed but unrelated RRset as the answer

NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

Hickory DNS failure to verify self-signed RRSIG for DNSKEYs