{"id":"CVE-2026-123572","kind":"vulnerability","aliases":["CVE-2026-123572"],"related":[],"title":"Hickory DNS: malformed SVCB alpn values crash zone file parsing","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","summary":"Hickory DNS, a Rust DNS library, panics when its hickory-proto parser reads a malformed alpn value in an SVCB or HTTPS record. An attacker who supplies an untrusted zone file can crash the process that parses it.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","package","rust","self-hosted"],"not_affected_if":["trusted-zone-files-only","versions-0.26.2-or-later"],"how_to_check":"- Check the hickory-proto or hickory-dns version in Cargo.lock, for example `grep -A1 'name = \"hickory-proto\"' Cargo.lock`\n- Look for code that parses untrusted zone files with hickory-proto's presentation format parser","fix":"- `hickory-dns` `0.26.2` (fixed version from the advisory range: before 0.26.2 is affected)","status":"open","published_at":"2026-11-08T02:16:50+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:22:57+00:00","updated_at":"2026-11-08T02:22:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:57Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-dns` `0.26.2` (fixed version from the advisory range: before 0.26.2 is affected)","reach":"unknown","title":"Hickory DNS: malformed SVCB alpn values crash zone file parsing","impact":"low","summary":"Hickory DNS, a Rust DNS library, panics when its hickory-proto parser reads a malformed alpn value in an SVCB or HTTPS record. An attacker who supplies an untrusted zone file can crash the process that parses it.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dns","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"parsing process crashes when fed a malicious zone file","analyst_note":"","how_to_check":"- Check the hickory-proto or hickory-dns version in Cargo.lock, for example `grep -A1 'name = \"hickory-proto\"' Cargo.lock`\n- Look for code that parses untrusted zone files with hickory-proto's presentation format parser","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-zone-files-only","versions-0.26.2-or-later"],"who_is_affected":"Applications that embed hickory-proto or hickory-dns and parse zone files or SVCB/HTTPS records from sources they do not fully trust. Servers that only answer DNS queries from their own configuration, and do not parse attacker-supplied zone text, are less exposed. unknown whether the sources name specific downstream products.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000722,"input_tokens":4307,"output_tokens":583,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123572':13A,16A '-2026':12A,15A '0.20.1':68C '0.26.2':70C 'alpn':5A,42B,93C,110C 'attack':51B,95C 'comma':105C 'consecut':104C 'contain':71C 'crash':7A,59B,113C 'cve':11A,14A 'denial':73C 'dns':2A,17B,20B,27B,30B,66C 'escap':108C 'file':9A,57B,100C 'format':87C 'hickori':1A,19B,26B,36B,65C,80C 'hickory-dn':18B,64C 'hickory-proto':35B,79C 'host':25B 'https':48B,84C 'invalid':107C 'librari':31B 'malform':3A,41B,92C 'packag':21B 'panic':32B,90C 'paramet':111C 'pars':10A,63B,114C 'parser':38B,88C 'present':86C 'process':61B,115C 'proto':37B,81C 'quot':103C 'read':39B 'record':49B,85C 'rust':22B,29B 'self':24B 'self-host':23B 'servic':75C 'suppli':53B,97C 'svcb':4A,46B,82C 'unbalanc':102C 'untrust':55B,98C 'valu':6A,43B,94C 'vulner':76C 'zone':8A,56B,99C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed hickory-proto or hickory-dns and parse zone files or SVCB/HTTPS records from sources they do not fully trust. Servers that only answer DNS queries from their own configuration, and do not parse attacker-supplied zone text, are less exposed. unknown whether the sources name specific downstream products.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","high","package","rust","selfhosted"],"campaign_type":null,"search_a":"'-123572':13A,16A '-2026':12A,15A 'alpn':5A 'crash':7A 'cve':11A,14A 'dns':2A 'file':9A 'hickori':1A 'malform':3A 'pars':10A 'svcb':4A 'valu':6A 'zone':8A","search_b":"'alpn':42B 'attack':51B 'crash':59B 'dns':17B,20B,27B,30B 'file':57B 'hickori':19B,26B,36B 'hickory-dn':18B 'hickory-proto':35B 'host':25B 'https':48B 'librari':31B 'malform':41B 'packag':21B 'panic':32B 'pars':63B 'parser':38B 'process':61B 'proto':37B 'read':39B 'record':49B 'rust':22B,29B 'self':24B 'self-host':23B 'suppli':53B 'svcb':46B 'untrust':55B 'valu':43B 'zone':56B","search_c":"'0.20.1':68C '0.26.2':70C 'alpn':93C,110C 'attack':95C 'comma':105C 'consecut':104C 'contain':71C 'crash':113C 'denial':73C 'dns':66C 'escap':108C 'file':100C 'format':87C 'hickori':65C,80C 'hickory-dn':64C 'hickory-proto':79C 'https':84C 'invalid':107C 'malform':92C 'panic':90C 'paramet':111C 'pars':114C 'parser':88C 'present':86C 'process':115C 'proto':81C 'quot':103C 'record':85C 'servic':75C 'suppli':97C 'svcb':82C 'unbalanc':102C 'untrust':98C 'valu':94C 'vulner':76C 'zone':99C","first_public_at":"2026-09-03T21:28:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123572","severity":null,"published_at":"2026-11-08T02:16:50+00:00","modified_at":"2026-11-08T02:16:50+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99295,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:28:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99296,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.20.1-before-0.26.2-panic-dos-via-svcb-https-zone-parser","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}