CVE-2026-123570 · Package
NO FIX YET · SEE WHAT TO DO
The DNS message parser in hickory-proto preallocates memory based on untrusted record counts in the packet header before reading the records. A remote attacker can send a UDP datagram, or a spoofed response to a resolver, with the counts set to 65535 to force about 18MB of allocation per message.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications written in Rust that use hickory-proto (Hickory DNS) versions from 0.18 up to but not including 0.26.2 to parse DNS messages are exposed, especially those accepting DNS responses or queries from the network. Systems that do not parse DNS with this library, or that run a pinned version outside the affected range, can skip it.
Not affected if not-using-hickory-proto, version-0.26.2-or-later
Who cares cargo, dns, hickory-dns, rust
cargo tree -i hickory-proto0.26.2 or later (fixed version per the description; the product ranges were not supplied)The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.