CVE-2026-123572 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS, a Rust DNS library, panics when its hickory-proto parser reads a malformed alpn value in an SVCB or HTTPS record. An attacker who supplies an untrusted zone file can crash the process that parses it.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed hickory-proto or hickory-dns and parse zone files or SVCB/HTTPS records from sources they do not fully trust. Servers that only answer DNS queries from their own configuration, and do not parse attacker-supplied zone text, are less exposed. unknown whether the sources name specific downstream products.
Not affected if trusted-zone-files-only, versions-0.26.2-or-later
Who cares dns, hickory-dns, rust, self-hosted
grep -A1 'name = "hickory-proto"' Cargo.lockhickory-dns 0.26.2 (fixed version from the advisory range: before 0.26.2 is affected)Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.