{"id":"CVE-2026-123570","kind":"vulnerability","aliases":["CVE-2026-123570"],"related":[],"title":"Hickory DNS: crafted DNS message forces 18MB allocation per packet","description":"The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.","summary":"The DNS message parser in hickory-proto preallocates memory based on untrusted record counts in the packet header before reading the records. A remote attacker can send a UDP datagram, or a spoofed response to a resolver, with the counts set to 65535 to force about 18MB of allocation per message.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cargo","dns","hickory-dns","package","rust"],"not_affected_if":["not-using-hickory-proto","version-0.26.2-or-later"],"how_to_check":"- Check the hickory-proto version in your Cargo.lock or dependency tree, for example `cargo tree -i hickory-proto`\n- Check whether your service uses hickory-proto or hickory-resolver/hickory-server as a DNS parser or resolver","fix":"- hickory-proto: move to `0.26.2` or later (fixed version per the description; the product ranges were not supplied)","status":"open","published_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:23:00+00:00","updated_at":"2026-11-08T02:23:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:23:00Z","model":"claude-haiku-5-5","output":{"fix":"- hickory-proto: move to `0.26.2` or later (fixed version per the description; the product ranges were not supplied)","reach":"internet","title":"Hickory DNS: crafted DNS message forces 18MB allocation per packet","impact":"low","summary":"The DNS message parser in hickory-proto preallocates memory based on untrusted record counts in the packet header before reading the records. A remote attacker can send a UDP datagram, or a spoofed response to a resolver, with the counts set to 65535 to force about 18MB of allocation per message.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dns","cargo"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker drives large memory allocations, causing resource exhaustion","analyst_note":"Confirm the affected range and fixed version from the NVD and vendor advisory on github.com; the sources given did not include product ranges.","how_to_check":"- Check the hickory-proto version in your Cargo.lock or dependency tree, for example `cargo tree -i hickory-proto`\n- Check whether your service uses hickory-proto or hickory-resolver/hickory-server as a DNS parser or resolver\n- unknown otherwise","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-hickory-proto","version-0.26.2-or-later"],"who_is_affected":"Applications written in Rust that use hickory-proto (Hickory DNS) versions from 0.18 up to but not including 0.26.2 to parse DNS messages are exposed, especially those accepting DNS responses or queries from the network. Systems that do not parse DNS with this library, or that run a pinned version outside the affected range, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4320,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123570':13A,16A '-2026':12A,15A '0.18':89C '0.26.2':91C '18mb':7A,71B,131C '65535':67B,128C 'alloc':8A,73B,133C 'ancount':99C 'arcount':102C 'attack':49B,110C 'base':34B 'cargo':17B 'client/resolver':122C 'count':38B,64B,125C 'craft':3A 'cve':11A,14A 'data':108C 'datagram':54B,115C 'dns':2A,4A,18B,21B,25B,77C,88C 'field':104C 'forc':6A,69B,129C 'format':80C 'header':42B,103C 'hickori':1A,20B,30B,85C,87C 'hickory-dn':19B 'hickory-proto':29B,84C 'memori':33B 'messag':5A,26B,75B,81C,135C 'nscount':100C 'packag':22B 'packet':10A,41B 'parser':27B,82C 'per':9A,74B,134C 'prealloc':32B,92C 'proto':31B,86C 'read':44B,106C 'record':37B,46B,93C,107C 'remot':48B,109C 'resolv':61B 'respons':58B,119C 'rust':23B 'send':51B,112C 'set':65B,126C 'size':95C 'spoof':57B,118C 'udp':53B,114C 'untrust':36B,98C 'vector':94C 'wire':79C 'wire-format':78C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Rust that use hickory-proto (Hickory DNS) versions from 0.18 up to but not including 0.26.2 to parse DNS messages are exposed, especially those accepting DNS responses or queries from the network. Systems that do not parse DNS with this library, or that run a pinned version outside the affected range, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cargo","dns","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123570':13A,16A '-2026':12A,15A '18mb':7A 'alloc':8A 'craft':3A 'cve':11A,14A 'dns':2A,4A 'forc':6A 'hickori':1A 'messag':5A 'packet':10A 'per':9A","search_b":"'18mb':71B '65535':67B 'alloc':73B 'attack':49B 'base':34B 'cargo':17B 'count':38B,64B 'datagram':54B 'dns':18B,21B,25B 'forc':69B 'header':42B 'hickori':20B,30B 'hickory-dn':19B 'hickory-proto':29B 'memori':33B 'messag':26B,75B 'packag':22B 'packet':41B 'parser':27B 'per':74B 'prealloc':32B 'proto':31B 'read':44B 'record':37B,46B 'remot':48B 'resolv':61B 'respons':58B 'rust':23B 'send':51B 'set':65B 'spoof':57B 'udp':53B 'untrust':36B","search_c":"'0.18':89C '0.26.2':91C '18mb':131C '65535':128C 'alloc':133C 'ancount':99C 'arcount':102C 'attack':110C 'client/resolver':122C 'count':125C 'data':108C 'datagram':115C 'dns':77C,88C 'field':104C 'forc':129C 'format':80C 'header':103C 'hickori':85C,87C 'hickory-proto':84C 'messag':81C,135C 'nscount':100C 'parser':82C 'per':134C 'prealloc':92C 'proto':86C 'read':106C 'record':93C,107C 'remot':109C 'respons':119C 'send':112C 'set':126C 'size':95C 'spoof':118C 'udp':114C 'untrust':98C 'vector':94C 'wire':79C 'wire-format':78C","first_public_at":"2026-09-03T21:48:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123570","severity":null,"published_at":"2026-11-08T02:16:49+00:00","modified_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99291,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:48:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99292,"url":"https://www.vulncheck.com/advisories/hickory-dns-from-0.18-before-0.26.2-memory-amplification-dos-via-rr-counts","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}