DEBIAN-CVE-2026-123571: High severity debian/rust-hickory-dns vulnerability

Q: Which deployments are exposed to remote denial of service?

Deployments using Hickory DNS versions 0.26.0 through before 0.26.2 are exposed if they process attacker-supplied DNS wire-format records containing TSIG RDATA. The issue can be triggered remotely without authentication or user interaction.

Q: What is required to trigger the failure?

An attacker needs to send a crafted malformed TSIG record in DNS wire format. The malformed record causes an unchecked subtraction underflow during TSIG RDATA decoding.

Q: What is the impact on affected builds?

Builds with overflow checks enabled can panic and crash, resulting in denial of service. The provided information does not describe confidentiality or integrity impact.

Q: How can I determine whether a system is affected?

Check whether the deployed rust-hickory-dns software uses Hickory DNS 0.26.0 or 0.26.1 and processes DNS records with TSIG RDATA. Version 0.26.2 is outside the affected range.

Published Nov 8, 2026

Updated

Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-dns*

debian/rust-hickory-dns<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-dns to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade Hickory DNS to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to remote denial of service?

Deployments using Hickory DNS versions 0.26.0 through before 0.26.2 are exposed if they process attacker-supplied DNS wire-format records containing TSIG RDATA. The issue can be triggered remotely without authentication or user interaction.

What is required to trigger the failure?

An attacker needs to send a crafted malformed TSIG record in DNS wire format. The malformed record causes an unchecked subtraction underflow during TSIG RDATA decoding.

What is the impact on affected builds?

Builds with overflow checks enabled can panic and crash, resulting in denial of service. The provided information does not describe confidentiality or integrity impact.

How can I determine whether a system is affected?

Check whether the deployed rust-hickory-dns software uses Hickory DNS 0.26.0 or 0.26.1 and processes DNS records with TSIG RDATA. Version 0.26.2 is outside the affected range.

DEBIAN-CVE-2026-123571: High severity debian/rust-hickory-dns vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to remote denial of service?

What is required to trigger the failure?

What is the impact on affected builds?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote denial of service?

What is required to trigger the failure?

What is the impact on affected builds?

How can I determine whether a system is affected?