DEBIAN-CVE-2026-123572: High severity debian/rust-hickory-dns vulnerability

Q: Which deployments are exposed to this denial of service?

Deployments using hickory-dns versions from 0.20.1 before 0.26.2 are exposed when they parse untrusted zone files containing SVCB or HTTPS records.

Q: What must an attacker provide to trigger the crash?

An attacker must be able to supply an untrusted zone file with malformed alpn parameters. Examples include unbalanced quotes, consecutive commas, or invalid escape sequences.

Q: What is the impact of successful exploitation?

Malformed alpn input can cause the hickory-proto presentation-format parser to panic, crashing the process that performs the parsing. The reported impact is denial of service.

Published Nov 8, 2026

Updated

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-dns*

debian/rust-hickory-dns<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-dns to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Deployments using hickory-dns versions from 0.20.1 before 0.26.2 are exposed when they parse untrusted zone files containing SVCB or HTTPS records.

What must an attacker provide to trigger the crash?

An attacker must be able to supply an untrusted zone file with malformed alpn parameters. Examples include unbalanced quotes, consecutive commas, or invalid escape sequences.

What is the impact of successful exploitation?

Malformed alpn input can cause the hickory-proto presentation-format parser to panic, crashing the process that performs the parsing. The reported impact is denial of service.

DEBIAN-CVE-2026-123572: High severity debian/rust-hickory-dns vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What must an attacker provide to trigger the crash?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What must an attacker provide to trigger the crash?

What is the impact of successful exploitation?