CVE-2026-123574
Received Received - Intake

Zone File Parser Panic in Hickory DNS

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123574
EUVD
EUVD-2026-119333

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hickory_dns hickory_proto to 0.26.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in the Hickory DNS library's zone file parser. When processing a zone file, the parser crashes if any single token exceeds 4096 bytes, causing the application to stop functioning.

Detection Guidance

To detect this vulnerability, monitor applications using Hickory DNS versions 0.24.0 to 0.26.1 for crashes when processing zone files. Check logs for parser panics or application failures after zone file ingestion. No specific commands are provided in the resources, but inspecting zone files for tokens exceeding 4096 bytes may indicate potential exploitation attempts.

Impact Analysis

If you use an affected version of Hickory DNS and process untrusted zone files, attackers could exploit this flaw to crash your application, leading to service disruption and downtime.

Mitigation Strategies

Immediately upgrade to Hickory DNS version 0.26.2 or later to patch the vulnerability. If upgrading is not possible, restrict access to zone file parsing functionality or implement input validation to reject tokens longer than 4096 bytes before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...