{"id":"CVE-2026-123574","kind":"vulnerability","aliases":["CVE-2026-123574"],"related":[],"title":"Hickory DNS zone parser panics on long token, causing denial of service","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","summary":"The zone file parser in the hickory-proto Rust crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token is 4096 bytes or longer. An attacker who can supply untrusted zone files to an application using the parser can crash it, causing denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","package","rust"],"not_affected_if":["no-untrusted-zone-files","version-0.26.2-or-later"],"how_to_check":"- Check whether the project depends on `hickory-proto` in its `Cargo.lock` and note the version.\n- Look for any code that parses zone files supplied from outside the team (uploads, imports, API inputs).","fix":"- `hickory-proto` `0.26.2` (the first fixed version, per the range 0.24.0 before 0.26.2)","status":"open","published_at":"2026-11-08T02:16:50+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:22:56+00:00","updated_at":"2026-11-08T02:22:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:22:56Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-proto` `0.26.2` (the first fixed version, per the range 0.24.0 before 0.26.2)","reach":"unknown","title":"Hickory DNS zone parser panics on long token, causing denial of service","impact":"low","summary":"The zone file parser in the hickory-proto Rust crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token is 4096 bytes or longer. An attacker who can supply untrusted zone files to an application using the parser can crash it, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dns"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Parser panic crashes the application, causing denial of service","analyst_note":"","how_to_check":"- Check whether the project depends on `hickory-proto` in its `Cargo.lock` and note the version.\n- Look for any code that parses zone files supplied from outside the team (uploads, imports, API inputs).\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-zone-files","version-0.26.2-or-later"],"who_is_affected":"Applications that use the hickory-proto crate from Hickory DNS 0.24.0 up to but not including 0.26.2 to parse zone files, especially where the zone file content comes from untrusted sources. Systems that only use Hickory DNS to serve or resolve DNS without parsing untrusted zone files are less exposed. The sources do not say whether any default configuration parses zone files.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4274,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123574':15A,18A '-2026':14A,17A '0.24.0':39B,86C '0.26.2':41B,88C '4096':48B,99C 'applic':62B,112C 'attack':53B,103C 'byte':49B,100C 'caus':9A,69B,121C 'crash':67B 'crate':35B,82C 'cve':13A,16A 'denial':10A,70B,123C 'dns':2A,19B,22B,38B,85C 'file':27B,59B,75C,97C,109C 'hickori':1A,21B,32B,37B,80C,84C 'hickory-dn':20B 'hickory-proto':31B,79C 'long':7A 'longer':51B,102C 'packag':23B 'panic':5A,42B,89C,119C 'parser':4A,28B,65B,76C,115C 'proto':33B,81C 'rust':24B,34B 'servic':12A,72B,125C 'singl':45B,92C 'suppli':56B,106C 'token':8A,46B,93C 'trigger':117C 'untrust':57B,107C 'use':63B,113C 'zone':3A,26B,58B,74C,96C,108C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the hickory-proto crate from Hickory DNS 0.24.0 up to but not including 0.26.2 to parse zone files, especially where the zone file content comes from untrusted sources. Systems that only use Hickory DNS to serve or resolve DNS without parsing untrusted zone files are less exposed. The sources do not say whether any default configuration parses zone files.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123574':15A,18A '-2026':14A,17A 'caus':9A 'cve':13A,16A 'denial':10A 'dns':2A 'hickori':1A 'long':7A 'panic':5A 'parser':4A 'servic':12A 'token':8A 'zone':3A","search_b":"'0.24.0':39B '0.26.2':41B '4096':48B 'applic':62B 'attack':53B 'byte':49B 'caus':69B 'crash':67B 'crate':35B 'denial':70B 'dns':19B,22B,38B 'file':27B,59B 'hickori':21B,32B,37B 'hickory-dn':20B 'hickory-proto':31B 'longer':51B 'packag':23B 'panic':42B 'parser':28B,65B 'proto':33B 'rust':24B,34B 'servic':72B 'singl':45B 'suppli':56B 'token':46B 'untrust':57B 'use':63B 'zone':26B,58B","search_c":"'0.24.0':86C '0.26.2':88C '4096':99C 'applic':112C 'attack':103C 'byte':100C 'caus':121C 'crate':82C 'denial':123C 'dns':85C 'file':75C,97C,109C 'hickori':80C,84C 'hickory-proto':79C 'longer':102C 'panic':89C,119C 'parser':76C,115C 'proto':81C 'servic':125C 'singl':92C 'suppli':106C 'token':93C 'trigger':117C 'untrust':107C 'use':113C 'zone':74C,96C,108C","first_public_at":"2026-09-03T21:29:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123574","severity":null,"published_at":"2026-11-08T02:16:50+00:00","modified_at":"2026-11-08T02:16:50+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99299,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:29:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99300,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.24.0-before-0.26.2-denial-of-service-via-zone-file-parser","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}