Denial of Service Vulnerability in Hickory DNS Zone File Parser

CVE-2026-123574

What is CVE-2026-123574?

The zone file parser in the hickory-proto crate of Hickory DNS versions 0.24.0 through 0.25.0 is susceptible to a denial of service attack. When a token in a zone file is 4096 bytes or longer, the parser can panic, leading to unexpected application crashes. This vulnerability can be exploited by attackers who supply untrusted zone files to applications leveraging this parser, effectively rendering the service inoperable.

References