{"id":"CVE-2026-123573","kind":"vulnerability","aliases":["CVE-2026-123573"],"related":[],"title":"hickory-dns: crafted zone file crashes DNS parser via SVCB records","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","summary":"hickory-dns, a Rust DNS library and server, panics while parsing SVCB and HTTPS record presentation formats when a service parameter value is malformed by a stray quote. An attacker who can supply an untrusted zone file can crash the parsing process, causing a denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","hickory-proto","package","rust"],"not_affected_if":["no-svcb-https-parsing","trusted-zone-files-only"],"how_to_check":"- Check the hickory-dns version in your Cargo.lock or dependency tree, e.g. `cargo tree -i hickory-proto`\n- Confirm whether your application parses untrusted zone files containing SVCB or HTTPS records\n- Versions `0.20.1` through below `0.26.2` are in the affected range","fix":"- Move hickory-dns to `0.26.2` or later","status":"open","published_at":"2026-11-08T02:16:50+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:22:56+00:00","updated_at":"2026-11-08T02:22:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:56Z","model":"claude-haiku-5-5","output":{"fix":"- Move hickory-dns to `0.26.2` or later","reach":"unknown","title":"hickory-dns: crafted zone file crashes DNS parser via SVCB records","impact":"low","summary":"hickory-dns, a Rust DNS library and server, panics while parsing SVCB and HTTPS record presentation formats when a service parameter value is malformed by a stray quote. An attacker who can supply an untrusted zone file can crash the parsing process, causing a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","dns","hickory-dns","hickory-proto"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Parsing process crashes, causing denial of service","analyst_note":"","how_to_check":"- Check the hickory-dns version in your Cargo.lock or dependency tree, e.g. `cargo tree -i hickory-proto`\n- Confirm whether your application parses untrusted zone files containing SVCB or HTTPS records\n- Versions `0.20.1` through below `0.26.2` are in the affected range","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-zone-files-only","no-svcb-https-parsing"],"who_is_affected":"Applications that embed hickory-dns or hickory-proto and parse zone files or presentation-format SVCB/HTTPS records from sources they do not fully trust are exposed. Systems that only serve DNS from locally controlled zone files or do not parse untrusted input can skip it. Whether a network-facing parse path exists in a given deployment is unknown from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4287,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123573':15A,18A '-2026':14A,17A '0.20.1':80C '0.26.2':82C 'attack':58B,101C 'caus':71B 'contain':83C 'craft':4A 'crash':7A,67B,123C 'cve':13A,16A 'denial':73B,85C 'dns':3A,8A,19B,22B,30B,33B,78C 'doubl':112C 'file':6A,65B,106C 'format':45B,99C 'hickori':2A,21B,24B,29B,77C,92C 'hickory-dn':1A,20B,28B,76C 'hickory-proto':23B,91C 'https':42B,96C 'librari':34B 'malform':52B 'packag':26B 'panic':37B,121C 'paramet':49B,117C 'pars':39B,69B,125C 'parser':9A,100C 'present':44B,98C 'process':70B,126C 'proto':25B,93C 'quot':56B,113C 'record':12A,43B,97C 'replac':114C 'rust':27B,32B 'server':36B 'servic':48B,75B,87C,116C 'singl':110C 'stray':55B 'suppli':61B,103C 'svcb':11A,40B,94C 'trigger':119C 'untrust':63B,104C 'valu':50B,118C 'via':10A 'vulner':88C 'zone':5A,64B,105C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed hickory-dns or hickory-proto and parse zone files or presentation-format SVCB/HTTPS records from sources they do not fully trust are exposed. Systems that only serve DNS from locally controlled zone files or do not parse untrusted input can skip it. Whether a network-facing parse path exists in a given deployment is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","hickoryproto","high","package","rust"],"campaign_type":null,"search_a":"'-123573':15A,18A '-2026':14A,17A 'craft':4A 'crash':7A 'cve':13A,16A 'dns':3A,8A 'file':6A 'hickori':2A 'hickory-dn':1A 'parser':9A 'record':12A 'svcb':11A 'via':10A 'zone':5A","search_b":"'attack':58B 'caus':71B 'crash':67B 'denial':73B 'dns':19B,22B,30B,33B 'file':65B 'format':45B 'hickori':21B,24B,29B 'hickory-dn':20B,28B 'hickory-proto':23B 'https':42B 'librari':34B 'malform':52B 'packag':26B 'panic':37B 'paramet':49B 'pars':39B,69B 'present':44B 'process':70B 'proto':25B 'quot':56B 'record':43B 'rust':27B,32B 'server':36B 'servic':48B,75B 'stray':55B 'suppli':61B 'svcb':40B 'untrust':63B 'valu':50B 'zone':64B","search_c":"'0.20.1':80C '0.26.2':82C 'attack':101C 'contain':83C 'crash':123C 'denial':85C 'dns':78C 'doubl':112C 'file':106C 'format':99C 'hickori':77C,92C 'hickory-dn':76C 'hickory-proto':91C 'https':96C 'panic':121C 'paramet':117C 'pars':125C 'parser':100C 'present':98C 'process':126C 'proto':93C 'quot':113C 'record':97C 'replac':114C 'servic':87C,116C 'singl':110C 'suppli':103C 'svcb':94C 'trigger':119C 'untrust':104C 'valu':118C 'vulner':88C 'zone':105C","first_public_at":"2026-09-03T21:28:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123573","severity":null,"published_at":"2026-11-08T02:16:50+00:00","modified_at":"2026-11-08T02:16:50+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99297,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wgfr-mphw-j5g4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:28:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99298,"url":"https://www.vulncheck.com/advisories/hickory-dns-from-0.20.1-before-0.26.2-panic-in-svcb-https-zone-file-parser","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}