https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 20:01:57 +0000 https://db.gcve.eu/vuln/rustsec-2026-0488 <p><strong>Affected:</strong> crates.io: hickory-proto</p> <p>When a TSIG record is decoded from the DNS wire format, its MAC length and &#34;other data&#34; length are checked against the end of the record data. If a check failed, the error value was built from `end_idx - decoder.index()`. For a malformed record the decoder can already be past `end_idx`, so this unsigned subtraction underflows.</p> <p>In builds with overflow checks enabled (the `dev` profile by default) the underflow panics, so a peer that sends a crafted TSIG record can crash the process. In builds without overflow checks the result wraps and is only used in the returned error.</p> <p>The fix returns a plain &#34;insufficient bytes&#34; error without the subtraction. It is in 0.26.2.</p> <p><strong>Affected:</strong> crates.io: hickory-proto</p> <p>When a TSIG record is decoded from the DNS wire format, its MAC length and &#34;other data&#34; length are checked against the end of the record data. If a check failed, the error value was built from `end_idx - decoder.index()`. For a malformed record the decoder can already be past `end_idx`, so this unsigned subtraction underflows.</p> <p>In builds with overflow checks enabled (the `dev` profile by default) the underflow panics, so a peer that sends a crafted TSIG record can crash the process. In builds without overflow checks the result wraps and is only used in the returned error.</p> <p>The fix returns a plain &#34;insufficient bytes&#34; error without the subtraction. It is in 0.26.2.</p> https://db.gcve.eu/vuln/rustsec-2026-0488