{"id":"CVE-2026-123572","aliases":["DEBIAN-CVE-2026-123572","EUVD-2026-119331","GHSA-hx8c-fjhc-hmf5","GHSA-j8hx-pr94-c5mv","RUSTSEC-2026-0487","UBUNTU-CVE-2026-123572"],"status":"published","title":"Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00343,"percentile":0.28274,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1286"],"published":"2026-09-03T12:00:00Z","modified":"2026-11-11T12:30:02Z","fixes":[{"ecosystem":"Debian:14","package":"rust-hickory-dns","fixed_in":["0.26.3-1"],"sources":["osv"]},{"ecosystem":"crates.io","package":"hickory-proto","fixed_in":["0.26.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.1-2","0.26.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.3-1"}]}],"versions":["0.24.4-1","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.1-2"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.20.1"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.25.2-3","0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1"]}],"products":[{"vendor":"hickory-dns","product":"hickory-dns"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5","tags":["vendor-advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.20.1-before-0.26.2-panic-dos-via-svcb-https-zone-parser","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123572","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j8hx-pr94-c5mv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123572.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123572","tags":["advisory"]},{"url":"https://crates.io/crates/hickory-proto","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0487.html","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/80eaf9e79f7561e2bc1cf5b89eaba7fd25de3284","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-123572","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123572","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123572","title":"Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","status":"published","published":"2026-11-08T01:38:09.285Z","modified":"2026-11-12T17:51:02.771Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1286"],"updated_at":"2026-11-08T02:36:49.037074Z"}],"euvd":[{"id":"EUVD-2026-119331","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","status":"published","published":"2026-11-08T01:38:09Z","modified":"2026-11-08T01:38:09Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T06:12:04.782489Z"}],"ghsa":[{"id":"GHSA-j8hx-pr94-c5mv","title":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory...","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","status":"published","published":"2026-11-08T03:30:34Z","modified":"2026-11-08T03:30:39Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1286"],"updated_at":"2026-11-08T03:41:53.166172Z"}],"nvd":[{"id":"CVE-2026-123572","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","status":"published","published":"2026-11-08T02:16:50.14Z","modified":"2026-11-10T22:15:59.797Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1286"],"updated_at":"2026-11-08T07:09:05.855788Z"}],"osv":[{"id":"CVE-2026-123572","title":"Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","status":"published","published":"2026-11-08T01:38:09.285Z","modified":"2026-11-12T02:48:30.654028867Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1286"],"updated_at":"2026-11-12T03:30:55.144331Z"},{"id":"DEBIAN-CVE-2026-123572","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","status":"published","published":"2026-11-08T02:16:50.14Z","modified":"2026-11-11T09:47:35.495534432Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-08T15:06:31.529325Z"},{"id":"UBUNTU-CVE-2026-123572","description":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:49:53.686863223Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-10T03:18:58.105788Z"},{"id":"RUSTSEC-2026-0487","title":"Panic on a malformed `alpn` value when parsing SVCB or HTTPS records from text","description":"When an SVCB or HTTPS record is parsed from its text (zone file) form, the `alpn` service parameter value is split into a list of protocol names. That step called `expect` on the result, on the assumption that it could not fail. A malformed value, such as one with an unbalanced quote (`alpn=\"h`), two commas in a row or an invalid escape, makes it fail, so the parser panicked instead of returning an error.\n\nCode that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.\n\nThe fix returns a parse error instead. It is in 0.26.2.","status":"published","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T09:45:02.502326297Z","updated_at":"2026-11-12T10:16:30.501395Z"}]}}