GHSA-67wc-6jq8-ghrc: Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts

Published Nov 8, 2026

Updated

The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-proto to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can trigger the excessive allocation?

A remote attacker can send a malicious UDP DNS datagram directly, or send a spoofed DNS response to a client or resolver that parses it. The attacker-controlled DNS header record counts can cause approximately 18 MB of allocation for each processed message.

Which deployments are affected?

The issue affects hickory-proto versions from 0.18 up to, but not including, 0.26.2. Any application, client, or resolver using an affected parser to process attacker-supplied DNS messages may be exposed.

What is the immediate mitigation if upgrading is not possible?

The provided information does not identify a configuration workaround. Reducing exposure to untrusted UDP DNS traffic and preventing spoofed DNS responses from reaching affected clients or resolvers can limit the described attack path.

GHSA-67wc-6jq8-ghrc: Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts

Remediation

Event History

Frequently Asked Questions

Who can trigger the excessive allocation?

Which deployments are affected?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the excessive allocation?

Which deployments are affected?

What is the immediate mitigation if upgrading is not possible?