UBUNTU-CVE-2026-123573: High severity ubuntu/rust-hickory-dns vulnerability
hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.
Affected Software
Event History
Frequently Asked Questions
What attacker-controlled input is required to trigger the denial of service?
An attacker must be able to supply an untrusted DNS zone file containing an SVCB or HTTPS record whose service parameter value is replaced by a single quote or double quote. Parsing that record can panic and crash the parsing process.
Which component and versions are affected?
The issue affects the hickory-proto SVCB and HTTPS record presentation-format parser in hickory-dns versions from 0.20.1 before 0.26.2.
Is authentication or user interaction required?
No. The severity vector indicates network attack access with low complexity, no privileges required, and no user interaction.