The zone file parser in the hickory‑proto crate will panic when it encounters a token that is 4096 bytes or longer, bringing the parsing process to a halt and causing a denial of service for any application that loads such zone files. This weakness represents an improper input validation flaw (CWE‑20) that violates defensive parsing practices.

The vulnerability affects Hickory DNS versions 0.24.0 through 0.26.1, which incorporate the hickory‑proto crate. Any application that processes zone files with this crate is at risk, regardless of its deployment context.

The CVSS score of 8.7 indicates high severity. The EPSS score is currently unavailable, so exploitation probability is uncertain. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. Attackers who can supply a zone file—via load requests or administrative interfaces—can trigger a parsing panic by including a single token of at least 4096 bytes. The mount of the exploit is straightforward, relying only on the ability to supply the oversized token, with the consequence of halting DNS services or applications using the parser.