GHSA-x962-5xwx-fr8x: Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding

Published Nov 8, 2026

Updated

Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Hickory DNS to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Hickory DNS versions from 0.26.0 up to, but not including, 0.26.2 are affected. The denial-of-service condition applies to builds with overflow checks enabled.

What does an attacker need to exploit this issue?

An attacker needs to be able to send a crafted TSIG record in DNS wire format to the affected deployment. No further prerequisites are provided.

What is the impact of successful exploitation?

Malformed TSIG RDATA can cause an unchecked subtraction to underflow and trigger a panic. This can crash the affected process and result in denial of service.

GHSA-x962-5xwx-fr8x: Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?