GHSA-wgfr-mphw-j5g4: hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser

Published Nov 8, 2026

Updated

hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Deployments using hickory-dns versions from 0.20.1 before 0.26.2 are exposed when they parse untrusted zone files containing SVCB or HTTPS records.

What input is required to trigger the crash?

An attacker must be able to supply an untrusted zone file. In an SVCB or HTTPS record, replacing a service parameter value with only a single quote or double quote triggers a panic in the presentation-format parser.

What is the impact of successful exploitation?

The parser process panics and crashes, causing a denial of service.

GHSA-wgfr-mphw-j5g4: hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What input is required to trigger the crash?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What input is required to trigger the crash?

What is the impact of successful exploitation?