UBUNTU-CVE-2026-123574: High severity ubuntu/rust-hickory-proto vulnerability
The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using the hickory-proto zone file parser are exposed if they accept zone files from untrusted sources. An attacker does not need privileges or user interaction, but must be able to supply a crafted zone file to the application.
What input triggers the parser failure?
A zone file containing a single token that is 4096 bytes or longer triggers a parser panic. The impact is denial of service through application termination or disruption caused by that panic.
Which versions are affected?
Hickory DNS versions from 0.24.0 up to, but not including, 0.26.2 are affected. Updating to 0.26.2 or later addresses the issue.
What can be done if updating is not immediately possible?
Do not pass untrusted zone files to the parser. Where zone-file intake cannot be disabled, reject or constrain inputs containing tokens of 4096 bytes or more before parsing.