Description

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-07-23T09:16:27.080Z",
  "pubdate": "2026-07-23T09:16:27.080Z",
  "executiveSummary": "This vulnerability involves an architectural flaw in DNSSEC validation logic concerning RRSIG records with an insufficient number of labels.\nThe primary impact of this security defect is the potential bypass of cryptographic wildcard validation mechanisms within the Domain Name System Security Extensions.\nThe affected systems and products include DNS resolvers and authoritative name servers that perform cryptographic validation of DNSSEC signatures.\nThe risk implications are severe, as successful exploitation undermines the integrity and authenticity guarantees provided by DNSSEC, potentially exposing clients to cache poisoning, domain spoofing, and man-in-the-middle attacks.\nAn attacker possessing the capability to forge or manipulate DNS responses containing specially crafted RRSIG records can exploit this flaw.\nExploitation requirements include positioning oneself in the network path or compromising authoritative name servers to inject malicious responses that evade proper label-count verification during the validation chain.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling and verification of the label count field present in RRSIG records during DNSSEC wildcard expansion validation.\nWhen a resolver validates a DNS response that matches a wildcard, it must verify that the number of labels in the RRSIG owner name matches or exceeds the label count specified in the RRSIG RDATA, accounting for wildcard synthesis.\nIf the validation engine fails to correctly enforce minimum label count constraints or incorrectly processes RRSIGs with too few labels, it misinterprets the provenance of the synthesized record.\nThe vulnerable component is the DNSSEC cryptographic validation module responsible for checking signature validity against the original wildcard domain structure.\nNetwork exposure is inherent to any publicly accessible DNS resolver or recursive server processing untrusted DNS responses from the global internet.\nAuthentication and privilege requirements are generally none for remote attackers, provided they can influence or control the DNS responses received by the vulnerable resolver.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious response containing a wildcard-generated record accompanied by an RRSIG with a manipulated or artificially low label count.\nSecond, the vulnerable DNS resolver initiates the validation process for the resource record set but fails to adequately check the label count constraint against the RRSIG metadata.\nThird, the validation algorithm incorrectly accepts the cryptographic signature as valid for the queried domain name, bypassing the strict checks designed to prevent unauthorized wildcard synthesis.\nFinally, the resolver caches and returns the fraudulent DNS data to the client, leading to successful spoofing of arbitrary subdomains under the targeted zone.\nPost-exploitation impact includes persistent traffic interception, redirection of sensitive communications, and complete compromise of DNS resolution integrity for the affected resolver population."
}