CVE-2026-123573 · Package
NO FIX YET · SEE WHAT TO DO
hickory-dns, a Rust DNS library and server, panics while parsing SVCB and HTTPS record presentation formats when a service parameter value is malformed by a stray quote. An attacker who can supply an untrusted zone file can crash the parsing process, causing a denial of service.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed hickory-dns or hickory-proto and parse zone files or presentation-format SVCB/HTTPS records from sources they do not fully trust are exposed. Systems that only serve DNS from locally controlled zone files or do not parse untrusted input can skip it. Whether a network-facing parse path exists in a given deployment is unknown from the sources.
Not affected if no-svcb-https-parsing, trusted-zone-files-only
Who cares dns, hickory-dns, hickory-proto, rust
cargo tree -i hickory-proto0.20.1 through below 0.26.2 are in the affected range0.26.2 or laterhickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.