UBUNTU-CVE-2026-123571: High severity ubuntu/rust-hickory-dns vulnerability
Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hickory DNSto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using Hickory DNS versions 0.26.0 through before 0.26.2 are affected when they decode attacker-supplied DNS wire-format TSIG records. The denial of service occurs on builds with overflow checks enabled.
What does an attacker need to exploit the flaw?
An attacker only needs to send a crafted malformed TSIG record in DNS wire format. No authentication or user interaction is required.
What is the practical impact of successful exploitation?
The malformed record triggers an unchecked subtraction underflow during TSIG RDATA decoding, causing a panic. This can crash the affected process and produce denial of service.