DEBIAN-CVE-2026-123574: High severity debian/rust-hickory-proto vulnerability

Q: Who is exposed to this denial-of-service issue?

Applications using the hickory-proto zone file parser are exposed if they accept zone files from untrusted sources. An attacker must be able to supply a crafted zone file to the application.

Q: What input triggers the failure?

A zone file containing a single token that is 4096 bytes or longer causes the parser to panic. The impact is denial of service.

Q: Which versions are affected?

Hickory DNS versions from 0.24.0 up to, but not including, 0.26.2 are affected.

Published Nov 8, 2026

Updated

The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-proto*

debian/rust-hickory-proto<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-proto to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Applications using the hickory-proto zone file parser are exposed if they accept zone files from untrusted sources. An attacker must be able to supply a crafted zone file to the application.

What input triggers the failure?

A zone file containing a single token that is 4096 bytes or longer causes the parser to panic. The impact is denial of service.

Which versions are affected?

Hickory DNS versions from 0.24.0 up to, but not including, 0.26.2 are affected.

DEBIAN-CVE-2026-123574: High severity debian/rust-hickory-proto vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What input triggers the failure?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What input triggers the failure?

Which versions are affected?