2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22866

CVE-2026-22866: ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation

Impact

The RSASHA256Algorithm and RSASHA1Algorithm contracts fail to validate PKCS#1 v1.5 padding structure when verifying RSA signatures. The contracts only check if the last 32 (or 20) bytes of the decrypted signature match the expected hash. This enables Bleichenbacher's 2006 signature forgery attack against DNS zones using RSA keys with low public exponents (e=3). Two ENS-supported TLDs (.cc and .name) use e=3 for their Key Signing Keys, allowing any domain under these TLDs to be fraudulently claimed on ENS without DNS ownership.

Affected contracts

Patches

The bug was reported via Immunefi with possible solutions. The patch was merged at https://github.com/ensdomains/ens-contracts/commit/c76c5ad0dc9de1c966443bd946fafc6351f87587

Workarounds

Deploy the patched contracts
Point DNSSECImpl.setAlgorithm to the deployed contract

Resources

https://github.com/ensdomains/ens-contracts-bug-62248-pr-509

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22866

CVE-2026-22866:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@ensdomains/ens-contracts	npm	<= 1.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated patch commit c76c5ad0dc9de1c966443bd946fafc6351f87587 clearly indicates that the RSASHA1Algorithm and RSASHA256Algorithm contracts were vulnerable to RSA signature forgery. The vulnerability stemmed from the improper verification of the PKCS#1 v1.5 padding in the verify functions of these contracts.

The original code recovered the signed message and only checked if the message ended with the expected hash (SHA1 or SHA256). It did not verify the padding bytes, which is a critical step in preventing signature forgery attacks like the one described by Bleichenbacher in 2006.

The patch addresses this by introducing a new library, RSAPKCS1Verify.sol, which includes a function recoverAndVerify. This new function explicitly checks for the correct PKCS#1 v1.5 padding structure (0x00 0x01 [0xFF padding] 0x00 [DigestInfo] [Hash]). The verify functions in both RSASHA1Algorithm.sol and RSASHA256Algorithm.sol were updated to use this new library, thus mitigating the vulnerability.

The addition of the test file TestRSAForgedSignature.test.ts further confirms the vulnerability and the effectiveness of the patch by simulating the attack and asserting that the forged signature is correctly rejected by the patched code.

Vulnerable functions

RSASHA1Algorithm.verify

contracts/dnssec-oracle/algorithms/RSASHA1Algorithm.sol

The `verify` function in the `RSASHA1Algorithm` contract was vulnerable to RSA signature forgery. It used `RSAVerify.rsarecover` to recover the message from the signature but only checked if the last 20 bytes of the recovered data matched the SHA-1 hash of the input data. It failed to validate the PKCS#1 v1.5 padding structure, which allowed an attacker to forge a valid signature for keys with a low public exponent (e=3) without possessing the private key. The vulnerability is a classic Bleichenbacher's signature forgery attack.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

2.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-22866: ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation

Impact

Patches

Workarounds

Resources

CVE-2026-22866:

2.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

2.7

2.7

Technical Details

Basic Information

Basic Information

CVE-2026-22866: ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation

Impact

Patches

Workarounds

Resources

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI