CVE-2026-123574: Input Validation

Published Nov 8, 2026

Updated

The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Applications using the hickory-proto zone file parser in Hickory DNS versions 0.24.0 before 0.26.2 are affected if they accept zone files from untrusted sources.

What input is required to trigger the failure?

An attacker needs to supply a zone file containing a single token that is 4096 bytes or longer. Parsing that file causes the parser to panic, resulting in denial of service.

What version resolves the issue?

Upgrade to Hickory DNS 0.26.2 or later. The affected range is 0.24.0 before 0.26.2.

CVE-2026-123574: Input Validation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What input is required to trigger the failure?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What input is required to trigger the failure?

What version resolves the issue?