CVE-2026-123570 json
Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
published 2mo ago modified 1h ago also EUVD-2026-119455 , GHSA-67wc-6jq8-ghrc , RUSTSEC-2026-0491
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.
Patch / fix
- crates.io hickory-proto 0.26.2
- hickory-dns hickory-dns 0.26.2
- rust-hickory-proto Debian 14 0.26.3-1
debian advisories DEBIAN-CVE-2026-123570
Is CVE-2026-123570 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2d ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | hickory-proto | >=0.18.0, <0.26.2 |
0.26.2 |
Affected products
- hickory-dns hickory-dns
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/hickory-dns/hickory-dns/commit/280c0e5c4e3002d73ba0762835ef82272d1d33a6
web
-
github.com
/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc
vendor-advisory, advisory
-
vulncheck.com
/advisories/hickory-dns-from-0.18-before-0.26.2-memory-amplification-dos-via-rr-counts
third-party-advisory
-
crates.io
/crates/hickory-proto
package
-
rustsec.org
/advisories/RUSTSEC-2026-0491.html
advisory
Sources
- CVE List CVE-2026-123570
- NVD CVE-2026-123570
- OSV RUSTSEC-2026-0491
- Maintainer advisory GHSA-67wc-6jq8-ghrc
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of hickory-dns/hickory-dns published their own advisory on GitHub. Reviewed sources take precedence over it.