{"id":"CVE-2026-123573","aliases":["DEBIAN-CVE-2026-123573","EUVD-2026-119332","GHSA-9x38-fc36-mpgq","GHSA-wgfr-mphw-j5g4","RUSTSEC-2026-0489","UBUNTU-CVE-2026-123573"],"status":"published","title":"hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00343,"percentile":0.28275,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-09-03T12:00:00Z","modified":"2026-11-11T12:30:02Z","fixes":[{"ecosystem":"Debian:14","package":"rust-hickory-dns","fixed_in":["0.26.3-1"],"sources":["osv"]},{"ecosystem":"crates.io","package":"hickory-proto","fixed_in":["0.26.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.1-2","0.26.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.3-1"}]}],"versions":["0.24.4-1","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.1-2"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.20.1"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.25.2-3","0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1"]}],"products":[{"vendor":"hickory-dns","product":"hickory-dns"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wgfr-mphw-j5g4","tags":["vendor-advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-from-0.20.1-before-0.26.2-panic-in-svcb-https-zone-file-parser","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123573","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9x38-fc36-mpgq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123573.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123573","tags":["advisory"]},{"url":"https://crates.io/crates/hickory-proto","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0489.html","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/c663b60a4b4b98deb45d16ccbf10ce2f76cd88a9","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-123573","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123573","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123573","title":"hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","status":"published","published":"2026-11-08T01:38:09.961Z","modified":"2026-11-10T17:58:09.934Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-08T02:36:49.037074Z"}],"euvd":[{"id":"EUVD-2026-119332","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","status":"published","published":"2026-11-08T01:38:09Z","modified":"2026-11-10T17:58:09Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T06:12:04.782489Z"}],"ghsa":[{"id":"GHSA-9x38-fc36-mpgq","title":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory...","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","status":"published","published":"2026-11-08T03:30:34Z","modified":"2026-11-08T03:30:40Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-08T03:41:54.072675Z"}],"nvd":[{"id":"CVE-2026-123573","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","status":"published","published":"2026-11-08T02:16:50.297Z","modified":"2026-11-10T22:15:59.797Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-10T20:21:09.207118Z"}],"osv":[{"id":"CVE-2026-123573","title":"hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","status":"published","published":"2026-11-08T01:38:09.961Z","modified":"2026-11-12T02:48:34.898192658Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-12T03:30:48.739835Z"},{"id":"DEBIAN-CVE-2026-123573","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","status":"published","published":"2026-11-08T02:16:50.297Z","modified":"2026-11-11T10:00:51.985990843Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-11T10:35:16.464644Z"},{"id":"UBUNTU-CVE-2026-123573","description":"hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:49:53.273987074Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-10T03:18:58.105788Z"},{"id":"RUSTSEC-2026-0489","title":"Panic when an SVCB or HTTPS parameter value is a single quote character","description":"When an SVCB or HTTPS record is parsed from its text (zone file) form, surrounding double quotes are removed from each service parameter value by checking that the value starts and ends with `\"` and slicing off the first and last character. A value that is a single `\"` (for example `alpn=\"`) passes that check, and the slice `[1..0]` panics.\n\nCode that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.\n\nThe fix rejects a lone quote character with a parse error before the slice. It is in 0.26.2.","status":"published","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T09:45:02.52485778Z","updated_at":"2026-11-12T10:16:30.501395Z"}]}}