hickory-dns versions 0.20.1 through 0.26.1 contain a high‑severity denial of service vulnerability in the SVCB and HTTPS record parser. An attacker who can supply an untrusted zone file to the DNS server can insert a single or double quote where a service parameter value should appear. This malformed value triggers a panic that crashes the parsing process, causing the entire DNS service to become unavailable until restarted.

The vulnerability affects the hickory-dns DNS server product. Any deployment running version 0.20.1 up to and including 0.26.1 is susceptible. Versions 0.26.2 and later contain the remedial fix and are not impacted.

The CVSS score of 8.7 indicates a high risk if exploited. While the EPSS score is not available, the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation at this time. The likely attack vector involves a malicious or corrupted zone file that the DNS server processes, which is typically limited to environments that load external or untrusted zone data. In such cases the exploit can cause a service outage, but it does not provide a remote code execution path or compromise data confidentiality.