PT-2026-21935 · Unknown · Rsasha256Algorithm+4

Lowmakoto · Publicado 2026-02-25 · Atualizado 2026-03-13 · CVE-2026-22866

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ethereum Name Service (ENS) versions 1.6.2 and prior

Description The RSASHA256Algorithm and RSASHA1Algorithm contracts do not properly validate PKCS#1 v1.5 padding when verifying RSA signatures. The contracts only verify the final 32 or 20 bytes of the decrypted signature against the expected hash. This allows for a Bleichenbacher's 2006 signature forgery attack against DNS zones utilizing RSA keys with a low public exponent (e=3). Two TLDs supported by ENS, .cc and .name, use e=3 for their Key Signing Keys, potentially allowing fraudulent claims of domains under these TLDs on ENS without actual DNS ownership. The vulnerable contracts include RSASHA256Algorithm at address 0x9D1B5a639597f558bC37Cf81813724076c5C1e96, RSASHA1Algorithm at address 0x6ca8624Bc207F043D140125486De0f7E624e37A1, DNSSECImpl at address 0x0fc3152971714E5ed7723FAFa650F86A4BaF30C5, and DNSRegistrar at address 0xB32cB5677a7C971689228EC835800432B339bA2B.

Recommendations Versions prior to 1.6.2 should deploy the patched contracts. Point the DNSSECImpl.setAlgorithm function to the deployed, patched contract.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2026-22866

GHSA-C6RR-7PMC-73WC

Produtos afetados

Dnsregistrar

Dnssecimpl

Ethereum Name Service

Rsasha1Algorithm

Rsasha256Algorithm

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22866.json · Exploit
• https://github.com/ensdomains/ens-contracts/commit/c76c5ad0dc9de1c966443bd946fafc6351f87587 · Correção
• https://github.com/ensdomains/ens-contracts/security/advisories/GHSA-c6rr-7pmc-73wc · Aviso do Fabricante
• https://github.com/ensdomains/ens-contracts · Nota
• https://github.com/ensdomains/ens-contracts-bug-62248-pr-509 · Correção
• https://osv.dev/vulnerability/CVE-2026-22866 · Aviso do Fabricante
• https://twitter.com/_cvereports/status/2026728983287505121 · Publicação no Twitter
• https://t.me/cveNotify/155376 · Publicação no Telegram
• https://t.me/CVEtracker/45744 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-22866 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-c6rr-7pmc-73wc · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027744277992722874 · Publicação no Twitter
• https://t.me/cveNotify/153475 · Publicação no Telegram