PT-2026-21935 · Unknown · Rsasha256Algorithm+4

Lowmakoto · Published 2026-02-25 · Updated 2026-03-13 · CVE-2026-22866

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ethereum Name Service (ENS) versions 1.6.2 and prior

Description The RSASHA256Algorithm and RSASHA1Algorithm contracts do not properly validate PKCS#1 v1.5 padding when verifying RSA signatures. The contracts only verify the final 32 or 20 bytes of the decrypted signature against the expected hash. This allows for a Bleichenbacher's 2006 signature forgery attack against DNS zones utilizing RSA keys with a low public exponent (e=3). Two TLDs supported by ENS, .cc and .name, use e=3 for their Key Signing Keys, potentially allowing fraudulent claims of domains under these TLDs on ENS without actual DNS ownership. The vulnerable contracts include RSASHA256Algorithm at address 0x9D1B5a639597f558bC37Cf81813724076c5C1e96, RSASHA1Algorithm at address 0x6ca8624Bc207F043D140125486De0f7E624e37A1, DNSSECImpl at address 0x0fc3152971714E5ed7723FAFa650F86A4BaF30C5, and DNSRegistrar at address 0xB32cB5677a7C971689228EC835800432B339bA2B.

Recommendations Versions prior to 1.6.2 should deploy the patched contracts. Point the DNSSECImpl.setAlgorithm function to the deployed, patched contract.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-22866

GHSA-C6RR-7PMC-73WC

Affected Products

Dnsregistrar

Dnssecimpl

Ethereum Name Service

Rsasha1Algorithm

Rsasha256Algorithm

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22866.json · Exploit
• https://github.com/ensdomains/ens-contracts/commit/c76c5ad0dc9de1c966443bd946fafc6351f87587 · Patch
• https://github.com/ensdomains/ens-contracts/security/advisories/GHSA-c6rr-7pmc-73wc · Vendor Advisory
• https://github.com/ensdomains/ens-contracts-bug-62248-pr-509 · Patch
• https://osv.dev/vulnerability/CVE-2026-22866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22866 · Security Note
• https://osv.dev/vulnerability/GHSA-c6rr-7pmc-73wc · Vendor Advisory
• https://github.com/ensdomains/ens-contracts · Note
• https://twitter.com/_cvereports/status/2026728983287505121 · Twitter Post
• https://t.me/cveNotify/155376 · Telegram Post
• https://t.me/CVEtracker/45744 · Telegram Post
• https://twitter.com/CVEnew/status/2027744277992722874 · Twitter Post
• https://t.me/cveNotify/153475 · Telegram Post