DEBIAN-CVE-2026-123570: High severity debian/rust-hickory-proto vulnerability

Q: Which deployments are exposed to this issue?

Deployments using the affected hickory-proto DNS wire-format parser are exposed when they process remote DNS messages. This includes systems that accept UDP DNS datagrams and clients or resolvers that can receive spoofed DNS responses.

Q: What does an attacker need to do to trigger the denial of service?

No authentication or user interaction is required. An attacker can send a DNS message with ANCOUNT, NSCOUNT, and ARCOUNT header fields set to 65535, causing roughly 18 MB of memory allocation per processed message.

Q: What is the impact of repeated malicious messages?

Each malicious message can force about 18 MB of allocation before record data is read. Repeated messages can therefore consume memory and cause a denial of service.

Q: Which versions address the issue?

The issue affects hickory-proto versions before 0.26.2. Updating to 0.26.2 or later addresses the vulnerable preallocation behavior.

Published Nov 8, 2026

Updated

The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-proto*

debian/rust-hickory-proto<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-proto to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade hickory-proto (Hickory DNS) to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the affected hickory-proto DNS wire-format parser are exposed when they process remote DNS messages. This includes systems that accept UDP DNS datagrams and clients or resolvers that can receive spoofed DNS responses.

What does an attacker need to do to trigger the denial of service?

No authentication or user interaction is required. An attacker can send a DNS message with ANCOUNT, NSCOUNT, and ARCOUNT header fields set to 65535, causing roughly 18 MB of memory allocation per processed message.

What is the impact of repeated malicious messages?

Each malicious message can force about 18 MB of allocation before record data is read. Repeated messages can therefore consume memory and cause a denial of service.

Which versions address the issue?

The issue affects hickory-proto versions before 0.26.2. Updating to 0.26.2 or later addresses the vulnerable preallocation behavior.

DEBIAN-CVE-2026-123570: High severity debian/rust-hickory-proto vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the impact of repeated malicious messages?

Which versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the impact of repeated malicious messages?

Which versions address the issue?