{"id":"nlnetlabs-745b1c069e29","seq":212734,"kind":"release","title":"The peculiar case of NSEC processing using expanded wildcard records","url":"https://nlnetlabs.nl/news/2018/Jan/30/the-peculiar-case-of-nsec-processing-using-expanded-wildcard-records/","permalink":"https://vulnpulse.app/items/nlnetlabs-745b1c069e29","summary":"We discovered a vulnerability in the processing of wildcard synthesized NSEC records. The result was Unbound, Google public DNS, PowerDNS and Dnsmasq contained a flaw that made it possible to downgrade secure connections. While synthesis of NSEC records is allowed by RFC 4592 , these synthesized owner names should not be used in the NSEC processing. This does, however, happen in Unbound 1.6.7 and earlier versions. Ralph Dolmans wrote a blog post about the discovery and findings.","severity":null,"techs":["unbound","powerdns"],"cves":[],"tags":["security"],"source":{"id":"nlnetlabs","name":"NLnet Labs"},"published_at":"2018-01-29T23:00:00.000Z","fetched_at":"2026-10-22T11:26:42.716Z"}