Description
Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.
Published: 2026-11-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Hickory DNS versions 0.26.0 through 0.26.1 contain an integer underflow in the decoding of TSIG RDATA. A malicious DNS client can construct a malformed TSIG record that triggers the underflow, causing the server to panic and crash. The result is a denial of service to any client that queries the affected DNS server.

Affected Systems

The vulnerability affects the Hickory DNS server, a Rust-based DNS resolver. All releases from 0.26.0 up to but not including 0.26.2 are impacted; customers using 0.26.0, 0.26.1, or any earlier patch notes that lack the fix are vulnerable.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. No EPSS value is available, so the likelihood of exploitation cannot be quantified from the data provided. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can remotely trigger the crash simply by sending a crafted DNS query containing a malicious TSIG record, so the attack vector is remote and requires network access to the DNS server.

Generated by OpenCVE AI on November 8, 2026 at 02:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Hickory DNS to version 0.26.2 or later, which includes the fixed TSIG RDATA decoding logic.
  • If an upgrade is not immediately possible, disable TSIG authentication on the DNS server to prevent processing of malformed TSIG records.
  • As an intermediate measure, block inbound DNS traffic from untrusted networks or apply rate limiting to reduce the impact of repeated attack attempts.
  • Monitor DNS server logs for panic events or unexpected restarts, which could indicate exploitation attempts.

Generated by OpenCVE AI on November 8, 2026 at 02:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Description Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.
Title Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
Weaknesses CWE-191
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-08T01:38:08.593Z

Reserved: 2026-11-06T00:53:14.313Z

Link: CVE-2026-123571

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-08T02:16:49.990

Modified: 2026-11-08T02:16:49.990

Link: CVE-2026-123571

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T02:45:18Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)