CVE-2026-123570
Received Received - Intake

DNS Message Parser Memory Exhaustion in Hickory DNS

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123570
EUVD
EUVD-2026-119455

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hickory proto to 0.26.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123570 is a memory amplification denial-of-service (DoS) vulnerability in the Hickory DNS library's DNS wire-format message parser. The parser preallocates memory for record vectors based on attacker-controlled header fields (ANCOUNT, NSCOUNT, ARCOUNT) before validating the actual data. Attackers can exploit this by setting these fields to the maximum value (65535), forcing the allocation of up to 18MB of memory per request.

Detection Guidance

Monitor for unusual memory usage spikes in DNS services using hickory-proto versions before 0.26.2. Check for UDP traffic with DNS headers containing ANCOUNT, NSCOUNT, or ARCOUNT fields set to 65535. Use tools like tcpdump or Wireshark to capture and analyze DNS packets for these anomalies.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by consuming excessive memory on systems using vulnerable versions of Hickory DNS. Attackers can send malicious UDP datagrams or spoofed DNS responses to trigger the issue, potentially causing system slowdowns or crashes due to resource exhaustion.

Mitigation Strategies

Upgrade hickory-proto to version 0.26.2 or later. If immediate upgrade is not possible, implement network-level mitigations such as rate limiting DNS traffic or blocking suspicious UDP datagrams with extreme header values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123570. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...