CVE-2026-22866: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22866 is an RSA signature forgery vulnerability in the Ethereum Name Service (ENS) DNSSEC Oracle contracts, caused by missing PKCS#1 v1.5 padding validation. It affects the RSASHA256Algorithm and RSASHA1Algorithm smart contracts in @ensdomains/ens-contracts versions 1.6.2 and prior. The vulnerability was disclosed on February 25, 2026, with a patch merged at commit c76c5ad0dc9de1c966443bd946fafc6351f87587. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 2.7 (Low), reflecting a network-exploitable integrity impact with no authentication required (Github Advisory, ENS Security Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). The vulnerable contracts (RSASHA256Algorithm at 0x9D1B5a639597f558bC37Cf81813724076c5C1e96 and RSASHA1Algorithm at 0x6ca8624Bc207F043D140125486De0f7E624e37A1) only verify that the last 32 (or 20) bytes of the RSA-decrypted signature match the expected hash, without validating the full PKCS#1 v1.5 padding structure (i.e., the 0x00 0x01 [0xFF...] 0x00 [DigestInfo] prefix). This incomplete check enables Bleichenbacher's 2006 cube-root signature forgery attack against RSA keys with a low public exponent (e=3): an attacker can craft a value whose cube, when reduced modulo the public key, produces a byte string whose tail matches the target hash, bypassing verification entirely. Two ENS-supported TLDs — .cc and .name — use e=3 for their Key Signing Keys (KSKs), making all domains under these TLDs exploitable. The attack entry point is the DNSRegistrar contract (0xB32cB5677a7C971689228EC835800432B339bA2B) via its proveAndClaim() function (ENS Security Advisory, ENS Patch Repo).

Successful exploitation allows an attacker to fraudulently claim ownership of any domain under the .cc or .name TLDs on ENS without possessing actual DNS ownership, enabling domain takeover and impersonation attacks. This can redirect blockchain-based services — such as cryptocurrency wallets, dApps, and decentralized identity systems — associated with affected ENS names to attacker-controlled addresses. The attack costs approximately 100,000 gas (~$5 USD at typical gas prices), making it economically trivial to execute at scale against high-value domains. There is no confidentiality or availability impact; the harm is entirely to the integrity of ENS domain ownership records (ENS Patch Repo, Github Advisory).

A proof-of-concept exploit script (PoV.sh) was developed and included in the ENS remediation repository, demonstrating the full attack chain including forged signature acceptance and a complete DNSSEC proof chain via proveAndClaim() (ENS Patch Repo). The vulnerability was reported through Immunefi. As of the advisory date, there is no evidence of in-the-wild exploitation or public weaponization beyond the PoC included in the remediation materials. The EPSS score is approximately 0.016% (4th percentile), indicating low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA KEV catalog.

1. Identify target domains: Enumerate domains registered under .cc or .name TLDs that have ENS names, as both TLDs use RSA e=3 Key Signing Keys, making them vulnerable to the cube-root forgery attack.
2. Construct a forged DNSSEC signature: Using the cube-root attack (Bleichenbacher 2006), compute a value s such that s^3 mod n produces a byte string whose last 32 bytes match the SHA-256 hash of the target DNS zone data, without a valid PKCS#1 v1.5 padding prefix.
3. Build a fraudulent DNSSEC proof chain: Assemble a complete DNSSEC proof chain using the forged signature, mimicking a legitimate DNSSEC-signed delegation from the .cc or .name TLD KSK down to the target domain.
4. Submit to DNSRegistrar: Call the proveAndClaim() function on the DNSRegistrar contract (0xB32cB5677a7C971689228EC835800432B339bA2B), passing the forged DNSSEC proof chain as input.
5. Claim domain ownership: The vulnerable RSASHA256Algorithm.verify() returns true for the forged signature (since only the last 32 bytes are checked), causing DNSSECImpl to accept the fraudulent proof and DNSRegistrar to register the ENS name under the attacker's Ethereum address — without the attacker owning the DNS domain (ENS Patch Repo, ENS Security Advisory).

• Blockchain/On-chain: Unexpected ENS name registrations for .cc or .name domains where the registrant address does not correspond to the known DNS domain owner; on-chain calls to DNSRegistrar.proveAndClaim() (0xB32cB5677a7C971689228EC835800432B339bA2B) from unknown addresses for high-value domains.
• DNSSEC Proof Data: DNSSEC proof submissions containing RSA signatures that lack valid PKCS#1 v1.5 padding structure (missing 0x00 0x01 [0xFF...] 0x00 [DigestInfo] prefix) but pass the ENS on-chain verifier.
• Transaction Monitoring: Ethereum transactions interacting with DNSSECImpl (0x0fc3152971714E5ed7723FAFa650F86A4BaF30C5) or DNSRegistrar (0xB32cB5677a7C971689228EC835800432B339bA2B) that result in domain ownership changes for .cc or .name domains not initiated by the legitimate domain owner (ENS Security Advisory, ENS Patch Repo).

The patch was merged at commit c76c5ad0dc9de1c966443bd946fafc6351f87587, introducing a new RSAPKCS1Verify library that fully validates the PKCS#1 v1.5 padding structure (leading 0x00 0x01, minimum 8 bytes of 0xFF padding, 0x00 separator, and correct DigestInfo prefix) before accepting any RSA signature. As no patched npm package version has been published (the advisory lists "None" for patched versions), the recommended remediation is to deploy the patched RSASHA256Algorithm and RSASHA1Algorithm contracts from the patch commit and update DNSSECImpl by calling setAlgorithm(8, <new_RSASHA256_address>) and setAlgorithm(5, <new_RSASHA1_address>) via the security council multisig. Detailed deployment instructions, including DAO governance steps for ownership transfer, are provided in the ENS remediation repository (ENS Patch Repo, ENS Security Advisory, Patch Commit).

The vulnerability was reported to ENS through Immunefi, the blockchain-focused bug bounty platform, indicating responsible disclosure through an established channel. The advisory was published by ENS maintainer makoto on February 25, 2026, and the remediation repository includes a detailed proof-of-concept and step-by-step deployment guide, suggesting the ENS team treated this as a high-priority operational issue despite the "Low" severity label assigned in the GitHub advisory. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory materials (ENS Security Advisory, ENS Patch Repo).