UBUNTU-CVE-2026-123572: High severity ubuntu/rust-hickory-dns vulnerability
Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Processes using affected hickory-proto versions to parse SVCB or HTTPS presentation-format records from untrusted zone files are exposed. The issue is specifically triggered while parsing malformed alpn parameter values.
What must an attacker provide to trigger the crash?
An attacker needs to supply an untrusted zone file containing a malformed alpn value, such as one with unbalanced quotes, consecutive commas, or invalid escape sequences. No privileges or user interaction are required according to the supplied severity vector.
Which versions are affected?
Hickory-dns versions from 0.20.1 up to, but not including, 0.26.2 are affected. Upgrading to 0.26.2 or later addresses the vulnerable parser behavior.