GHSA-hx8c-fjhc-hmf5: Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser

Published Nov 8, 2026

Updated

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial of service issue?

Processes using affected Hickory-dns versions that parse untrusted zone files containing SVCB or HTTPS records are exposed. The vulnerable parsing path is in the hickory-proto presentation-format parser.

What input is required to trigger the crash?

An attacker must be able to supply a zone file with a malformed alpn parameter. Reported triggering forms include unbalanced quotes, consecutive commas, and invalid escape sequences.

What should be prioritized for remediation?

Upgrade affected Hickory-dns installations to version 0.26.2 or later. Until upgrading, avoid accepting or parsing untrusted zone files, especially files containing SVCB or HTTPS records with alpn parameters.

GHSA-hx8c-fjhc-hmf5: Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser

Event History

Frequently Asked Questions

Who is exposed to this denial of service issue?

What input is required to trigger the crash?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial of service issue?

What input is required to trigger the crash?

What should be prioritized for remediation?