Description

The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-07-23T09:16:26.967Z",
  "pubdate": "2026-07-23T09:16:26.967Z",
  "executiveSummary": "A critical vulnerability exists in DNSSEC validation logic involving wildcard expansion proofs. Specifically, NSEC and NSEC3 denial-of-existence records are improperly accepted without cryptographic signature validation when a wildcard query resolves to a CNAME or DNAME record type. This flaw undermines the core cryptographic guarantees of the Domain Name System Security Extensions protocol. Affected systems include DNS resolvers and validating stub resolvers that process authenticated DNS responses. The risk implication is severe, allowing remote adversaries capable of performing adversary-in-the-middle attacks or DNS response manipulation to spoof arbitrary domain names, bypass security controls, and redirect traffic to malicious destinations without detection by validating clients. Exploitation requires the attacker to position themselves to intercept or manipulate DNS traffic and craft malicious responses leveraging unvalidated wildcard proofs targeting CNAME or DNAME mappings. No specialized privileges or prior authentication are required, as the attack targets the public-facing recursive resolution infrastructure.",
  "technicalDetails": "The root cause of the vulnerability stems from a logical flaw in the DNSSEC record validation state machine, specifically within the handling of wildcard synthesized answers. According to DNSSEC protocol specifications, all resource records in a signed zone, including those generated via wildcard expansion, must be cryptographically covered by valid RRSIG (Resource Record Signature) proofs. Furthermore, NSEC or NSEC3 denial-of-existence proofs must be thoroughly validated to authenticate the non-existence of exact matches and to prove the legitimacy of the wildcard expansion itself. In the vulnerable implementations, when a query results in a wildcard expansion that points to a canonical name alias (CNAME) or delegation name (DNAME) record, the resolver fails to enforce proper cryptographic signature verification on the associated NSEC or NSEC3 records or accepts the synthesized response without verifying the chain of trust.\nThe step-by-step attack flow proceeds as follows: First, an attacker initiates or anticipates a DNS query for a non-existent subdomain within a vulnerable DNSSEC-signed zone that matches a wildcard pattern configured in the target zone. Second, the validating resolver queries the authoritative nameserver for the record. Third, the malicious or compromised authoritative nameserver responds with a forged or manipulated wildcard answer containing a CNAME or DNAME redirection, accompanied by NSEC or NSEC3 records that falsely claim to prove the validity of the wildcard expansion. Fourth, due to the flawed validation logic, the vulnerable resolver skips the cryptographic verification step for the NSEC/NSEC3 records and blindly accepts the unvalidated CNAME or DNAME redirection as authentic. Finally, the resolver caches and returns the malicious response to the requesting client, treating the forged record as cryptographically secure. Network exposure is universal across any system performing full DNSSEC validation. The payload behavior involves redirecting legitimate client traffic to attacker-controlled infrastructure, facilitating subsequent exploitation vectors such as phishing, man-in-the-middle data interception, or service disruption."
}