CVE-2026-123570 Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123570?
CVE-2026-123570 is a high-severity vulnerability in hickory-dns, published on 8 Nov 2026.
Official description
The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.
Weakness: CWE-400
Which versions are affected by CVE-2026-123570?
1 open source package ship an affected version, including hickory-proto.
| Package | Affected | Fixed in |
|---|---|---|
hickory-proto crates.io | From 0.18.0 | 0.26.2 |
How do I fix CVE-2026-123570?
Upgrade hickory-proto to 0.26.2 or later.
Is CVE-2026-123570 being exploited?
There is no known exploitation of CVE-2026-123570 in the wild and no public exploit code.
Sources
Also known as AZL-113197, DEBIAN-CVE-2026-123570, GHSA-67wc-6jq8-ghrc, GHSA-6rvc-hrvg-mqf2, RUSTSEC-2026-0491, UBUNTU-CVE-2026-123570.