CVE-2026-123572
Received Received - Intake

Hickory-dns Denial of Service via Malformed ALPN Parsing

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123572
EUVD
EUVD-2026-119331

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hickory dns to 0.26.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1286 The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Hickory-dns versions from 0.20.1 to 0.26.2 have a denial of service vulnerability in the SVCB and HTTPS record parser. The issue occurs when malformed alpn values with unbalanced quotes, consecutive commas, or invalid escapes cause the parser to panic and crash.

Detection Guidance

Detecting this vulnerability requires checking for crashes in Hickory DNS parsing processes when processing malformed SVCB or HTTPS records with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters. Monitor logs for panics or crashes in hickory-proto components.

Impact Analysis

Attackers can exploit this by providing malicious zone files to crash the DNS parsing process. This leads to service disruption, as the DNS server becomes unavailable until restarted.

Compliance Impact

This vulnerability could impact compliance by causing service outages, potentially violating availability requirements in GDPR and HIPAA. Downtime may lead to unauthorized access or data processing delays.

Mitigation Strategies

Upgrade Hickory DNS to version 0.26.2 or later to address the parsing vulnerability. Review and sanitize any untrusted zone files before processing to prevent malformed inputs from reaching the parser.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123572. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...