---
id: CVE-2026-123572
title: Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser
summary: >-
  Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service
  vulnerability in the hickory-proto SVCB and HTTPS record presentation format
  parser, which panics on malformed alpn values. Attackers can supply untrusted
  zone files with…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-1286
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns >= 0.20.1 < 0.26.2
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:09.285Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123572'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5
    label: GitHub Security Advisory (GHSA-hx8c-fjhc-hmf5)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-0.20.1-before-0.26.2-panic-dos-via-svcb-https-zone-parser
    label: >-
      VulnCheck Advisory: Hickory-dns 0.20.1 before 0.26.2 Panic DoS via
      SVCB/HTTPS Zone Parser
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.657Z'
---

## Overview

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

## Affected

- `hickory-dns >= 0.20.1 < 0.26.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.