{"id":"CVE-2026-123574","aliases":["DEBIAN-CVE-2026-123574","EUVD-2026-119333","GHSA-29xw-595w-jfj7","GHSA-4rph-pmrw-mwpw","RUSTSEC-2026-0490","UBUNTU-CVE-2026-123574"],"status":"published","title":"Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00343,"percentile":0.28273,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-09-03T12:00:00Z","modified":"2026-11-11T12:30:02Z","fixes":[{"ecosystem":"Debian:14","package":"rust-hickory-proto","fixed_in":["0.26.3-1"],"sources":["osv"]},{"ecosystem":"crates.io","package":"hickory-proto","fixed_in":["0.26.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-4.1","0.24.4-5","0.24.4-6","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.3-1"}]}],"versions":["0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-4.1","0.24.4-5","0.24.4-6","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.24.0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-6","0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-4.1","0.24.4-6"]}],"products":[{"vendor":"hickory-dns","product":"hickory-dns"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw","tags":["vendor-advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.24.0-before-0.26.2-denial-of-service-via-zone-file-parser","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123574","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-29xw-595w-jfj7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123574.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123574","tags":["advisory"]},{"url":"https://crates.io/crates/hickory-proto","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0490.html","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/0494e15c88fba612f9ecb4f013eb3b221822c867","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-123574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123574","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123574","title":"Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","status":"published","published":"2026-11-08T01:38:10.613Z","modified":"2026-11-09T14:31:12.367Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-08T02:36:49.037074Z"}],"euvd":[{"id":"EUVD-2026-119333","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","status":"published","published":"2026-11-08T01:38:10Z","modified":"2026-11-09T14:31:12Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T06:12:04.782489Z"}],"ghsa":[{"id":"GHSA-29xw-595w-jfj7","title":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a...","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","status":"published","published":"2026-11-08T03:30:34Z","modified":"2026-11-08T03:30:40Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-08T03:41:54.072675Z"}],"nvd":[{"id":"CVE-2026-123574","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","status":"published","published":"2026-11-08T02:16:50.45Z","modified":"2026-11-10T22:15:59.797Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-09T18:15:14.769091Z"}],"osv":[{"id":"CVE-2026-123574","title":"Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","status":"published","published":"2026-11-08T01:38:10.613Z","modified":"2026-11-12T02:30:24.897202406Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"DEBIAN-CVE-2026-123574","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","status":"published","published":"2026-11-08T02:16:50.45Z","modified":"2026-11-11T09:47:39.254508734Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-10T10:26:30.347596Z"},{"id":"UBUNTU-CVE-2026-123574","description":"The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:50:13.54062249Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-10T03:18:58.105788Z"},{"id":"RUSTSEC-2026-0490","title":"Zone file lexer panics on a token of 4096 or more characters","description":"The zone file lexer read each token in a loop capped at 4,096 iterations, with an `assert!` on the loop counter as a safety bound. A single token long enough to reach that bound, for example a very long name or character string in a zone file, triggered the assertion and the parser panicked instead of returning the token or an error.\n\nCode that parses zone files from an untrusted source can be made to panic, which is a denial of service.\n\nThe fix removes the iteration bound, so the lexer ends only when it reaches the end of a token or an error. It is in 0.26.2.","status":"published","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T09:31:57Z","updated_at":"2026-11-12T10:16:30.501395Z"}]}}