DEBIAN-CVE-2026-123573: High severity debian/rust-hickory-dns vulnerability

Q: What input must an attacker control to trigger the denial of service?

An attacker must be able to supply an untrusted DNS zone file that is parsed by hickory-proto. A service parameter value containing only a single quote or double quote can trigger a panic and crash the parsing process.

Q: Which deployments are exposed?

Deployments using rust-hickory-dns versions from 0.20.1 before 0.26.2 are affected when they parse untrusted zone files containing SVCB or HTTPS records. The provided information does not establish whether any particular default configuration parses such files.

Q: What is the impact of successful exploitation?

Successful exploitation crashes the process performing the parse, resulting in denial of service. The supplied severity vector indicates network reachability, low attack complexity, no required privileges or user interaction, and no stated confidentiality or integrity impact.

Published Nov 8, 2026

Updated

hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-dns*

debian/rust-hickory-dns<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-dns to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input must an attacker control to trigger the denial of service?

An attacker must be able to supply an untrusted DNS zone file that is parsed by hickory-proto. A service parameter value containing only a single quote or double quote can trigger a panic and crash the parsing process.

Which deployments are exposed?

Deployments using rust-hickory-dns versions from 0.20.1 before 0.26.2 are affected when they parse untrusted zone files containing SVCB or HTTPS records. The provided information does not establish whether any particular default configuration parses such files.

What is the impact of successful exploitation?

Successful exploitation crashes the process performing the parse, resulting in denial of service. The supplied severity vector indicates network reachability, low attack complexity, no required privileges or user interaction, and no stated confidentiality or integrity impact.

DEBIAN-CVE-2026-123573: High severity debian/rust-hickory-dns vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What input must an attacker control to trigger the denial of service?

Which deployments are exposed?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What input must an attacker control to trigger the denial of service?

Which deployments are exposed?

What is the impact of successful exploitation?