Description
Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.
Published: 2026-11-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via panic during zone parsing
Action: Deploy patch
AI Analysis

Impact

An error in the SVCB/HTTPS record parser of Hickory DNS causes the server to panic when encountering malformed alpn values, such as unbalanced quotes, consecutive commas, or invalid escape sequences. This results in a crash that disrupts service availability. The weakness aligns with CWE-1286, which indicates a denial of service caused by unexpected program termination. No code execution or information disclosure is possible from the described flaw.

Affected Systems

Hickory DNS version 0.20.1 through 0.26.1 is affected. The vulnerability manifests in the hickory-proto module used by the DNS server to parse zone files that include SVCB or HTTPS records.

Risk and Exploitability

With a CVSS score of 8.7, the vulnerability is considered high severity. The EPSS score is not available, and it has not been listed in CISA’s KEV catalog. Attackers would need to supply a zone file containing malicious SVCB/HTTPS records, which is typically possible over the network when the DNS server accepts zone updates from untrusted sources. The attack vector is likely remote, and the impact is a loss of availability of the DNS service, which could affect network operations or application delivery.

Generated by OpenCVE AI on November 8, 2026 at 02:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to hickory-dns 0.26.2 or newer, where the SVCB/HTTPS parser bug is fixed.
  • If an upgrade cannot be performed immediately, restrict zone file ingestion to trusted, authenticated sources and verify zone file integrity before processing.
  • As a workaround, disable SVCB and HTTPS record processing in the server configuration or use a downstream firewall to block zone data containing those record types until the patch is applied.

Generated by OpenCVE AI on November 8, 2026 at 02:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Description Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.
Title Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser
Weaknesses CWE-1286
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-08T01:38:09.285Z

Reserved: 2026-11-06T00:53:14.313Z

Link: CVE-2026-123572

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-08T02:16:50.140

Modified: 2026-11-08T02:16:50.140

Link: CVE-2026-123572

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T02:45:18Z

Weaknesses
  • CWE-1286

    Improper Validation of Syntactic Correctness of Input