UBUNTU-CVE-2026-123570: High severity ubuntu/rust-hickory-proto vulnerability
The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-prototo a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which systems are exposed to remote exploitation?
Systems that parse DNS messages using affected hickory-proto versions are exposed if they can receive attacker-controlled UDP DNS datagrams or accept spoofed DNS responses. No attacker privileges or user interaction are required.
What is the practical impact of a malicious DNS message?
An attacker can set DNS record-count fields to 65535 and cause approximately 18 MB of memory allocation for each parsed message. Repeated messages can exhaust available memory and cause a denial of service.
What should be done if patching cannot happen immediately?
Restrict exposure to untrusted DNS traffic where possible and reduce the ability of attackers to inject or spoof DNS responses. The provided information does not specify a complete workaround.
How can I determine whether my deployment is affected?
Check whether the application uses hickory-proto earlier than version 0.26.2 and parses DNS wire-format messages. The affected Ubuntu package is rust-hickory-proto.