---
id: "CVE-2026-123572"
page: "https://infrastack.ai/live/CVE-2026-123572"
kind: "vulnerability"
aliases: ["CVE-2026-123572"]
title: "Hickory DNS: malformed SVCB alpn values crash zone file parsing"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "hickory-dns", "package", "rust", "self-hosted"]
not_affected_if: ["trusted-zone-files-only", "versions-0.26.2-or-later"]
published_at: "2026-11-08T02:16:50+00:00"
first_seen_at: "2026-11-08T02:21:12+00:00"
updated_at: "2026-11-08T02:22:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123572", "first_seen_at": "2026-11-08T02:21:12+00:00"}]
exploit_sources: []
---

# Hickory DNS: malformed SVCB alpn values crash zone file parsing

Link for people: https://infrastack.ai/live/CVE-2026-123572 (this .md is for agents)

Hickory DNS, a Rust DNS library, panics when its hickory-proto parser reads a malformed alpn value in an SVCB or HTTPS record. An attacker who supplies an untrusted zone file can crash the process that parses it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the hickory-proto or hickory-dns version in Cargo.lock, for example `grep -A1 'name = "hickory-proto"' Cargo.lock`
- Look for code that parses untrusted zone files with hickory-proto's presentation format parser

## Fix

- `hickory-dns` `0.26.2` (fixed version from the advisory range: before 0.26.2 is affected)

## Timeline

- 2026-11-08T02:21:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123572

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.20.1-before-0.26.2-panic-dos-via-svcb-https-zone-parser

## From the sources

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_