CVE-2026-123571 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS versions from 0.26.0 before 0.26.2 have an integer underflow in how they decode TSIG records. A remote attacker can send a crafted DNS message that makes the server panic, causing denial of service.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments running Hickory DNS between 0.26.0 and 0.26.2 are exposed, and the crash happens when a malformed TSIG record reaches the decoder, so a server answering queries from the internet is the main concern. Builds with overflow checks enabled crash; the sources say the subtraction underflow is what triggers the panic, and the sources do not say whether release builds are affected differently.
Not affected if no-tsig-handling, versions-outside-range
Who cares dns, hickory-dns, rust
Unknown from the sources.
0.26.2 or laterHickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.