Blocky DNSSEC validation bypass and validation-cache scope pollution

Executive brief

Blocky, a DNS proxy and ad-blocker, contains a flaw in how it validates secure internet addresses (DNSSEC). An attacker can trick the system into accepting and caching fake website addresses, even when security features are turned on. This could allow hackers to redirect users to malicious websites, intercept emails, or disrupt online services by providing false connection information.

Technical details

Blocky DNSSEC validation can be bypassed via two primary flaws. First, the resolver incorrectly classifies responses without RRSIG records as 'Insecure' without verifying the DS/DNSKEY chain of trust, allowing unsigned forged answers for signed domains to be accepted. Second, the validation cache is keyed only by domain name and incorrectly treats unauthenticated NSEC/NSEC3 records as proof of DS absence. Additionally, the CachingResolver writes entries to the cache before the DNSSEC validation layer has finalized its decision, leading to persistent cache poisoning. Attackers controlling an upstream resolver or capable of intercepting DNS traffic can exploit these issues to serve malicious A, AAAA, or MX records. The issue is fixed in version 0.32.0.

Affected products

• 0xERR0R blocky >= 0.28.0, < 0.32.0

Timeline

• 2026-06-16: disclosed: Initial disclosure on GitHub Advisories
• 2026-06-19: advisory: Advisory updated and published
• 2026-06-19: patched: Fixed in version 0.32.0

References

• https://api.github.com/users/RealHurrison
• https://github.com/RealHurrison
• https://api.github.com/users/RealHurrison/gists%7B/gist_id%7D
• https://api.github.com/users/RealHurrison/repos
• https://avatars.githubusercontent.com/u/43513000?v=4
• https://api.github.com/users/RealHurrison/events%7B/privacy%7D