nsec3

About this tag
The nsec3 tag on WindowsForum.com covers discussions about the NSEC3 cryptographic record type used in DNSSEC. Recent content focuses on CVE-2026-1519, a denial-of-service vulnerability in DNSSEC insecure delegation validation that can be triggered by maliciously crafted NSEC3 data with excessive iteration counts. This flaw can cause sustained CPU exhaustion in DNS resolvers or validation services, leading to total loss of availability. The tag includes analysis of Microsoft's security advisories and the practical impact on Windows DNS infrastructure. Topics also involve the mechanics of NSEC3 iteration, validation paths, and mitigation strategies for enterprise IT environments.

  1. CVE-2026-1519: NSEC3 Iteration DoS in DNSSEC Insecure Delegation Validation

    There is total loss of availability in the affected DNS validation path, and Microsoft’s own wording makes clear that the issue can be abused to drive sustained CPU exhaustion during insecure delegation validation. In practical terms, CVE-2026-1519 is the sort of flaw that can turn a resolver or...