CVE-2026-123573: Input Validation

Published Nov 8, 2026

Updated

hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using hickory-dns versions 0.20.1 through versions before 0.26.2 are affected when they parse untrusted zone files containing SVCB or HTTPS records.

What must an attacker provide to trigger the denial of service?

An attacker needs to cause the target to parse an untrusted zone file with an SVCB or HTTPS service parameter whose value is replaced by a single quote or double quote. This triggers a parser panic and crashes the parsing process.

What is the available remediation?

Update hickory-dns to version 0.26.2 or later. If updating cannot happen immediately, avoid parsing untrusted zone files, particularly files containing SVCB or HTTPS records.

CVE-2026-123573: Input Validation

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker provide to trigger the denial of service?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker provide to trigger the denial of service?

What is the available remediation?