- Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain'

  logic can shadow a stub/forward zone by a legitimate parent's
  NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

diff --git a/services/cache/dns.c b/services/cache/dns.c
index f6ce272a5ea615b1da9d33bee0b0b72dfe46f4f8..98d07bc371ca571b903fe181ca85beacd467e2fa 100644 (file)
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -1065,7 +1065,7 @@ dns_cache_lookup(struct module_env* env,
        if(env->cfg->harden_below_nxdomain) {
                while(!dname_is_root(k.qname)) {
                        if(dpname && dpnamelen
-                               && !dname_subdomain_c(k.qname, dpname))
+                               && !dname_strict_subdomain_c(k.qname, dpname))
                                break; /* no synth nxdomain above the stub */
                        dname_remove_label(&k.qname, &k.qname_len);
                        h = query_info_hash(&k, flags);