CVE-2026-123573 hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123573?
CVE-2026-123573 is a high-severity vulnerability in hickory-dns, published on 8 Nov 2026.
Official description
hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.
Weakness: CWE-20
Which versions are affected by CVE-2026-123573?
1 open source package ship an affected version, including hickory-proto.
| Package | Affected | Fixed in |
|---|---|---|
hickory-proto crates.io | From 0.20.1 | 0.26.2 |
How do I fix CVE-2026-123573?
Upgrade hickory-proto to 0.26.2 or later.
Is CVE-2026-123573 being exploited?
There is no known exploitation of CVE-2026-123573 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-123573, GHSA-9x38-fc36-mpgq, GHSA-wgfr-mphw-j5g4, RUSTSEC-2026-0489, UBUNTU-CVE-2026-123573.