Reported

September 3, 2026

Issued

November 11, 2026

Package

hickory-proto (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#dns #zone-file #svcb #panic

Aliases

• GHSA-hx8c-fjhc-hmf5

References

• https://github.com/hickory-dns/hickory-dns/commit/80eaf9e79f7561e2bc1cf5b89eaba7fd25de3284

Patched

• >=0.26.2

Unaffected

• <0.20.1

Description

When an SVCB or HTTPS record is parsed from its text (zone file) form, the alpn service parameter value is split into a list of protocol names. That step called expect on the result, on the assumption that it could not fail. A malformed value, such as one with an unbalanced quote (alpn="h), two commas in a row or an invalid escape, makes it fail, so the parser panicked instead of returning an error.

Code that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.

The fix returns a parse error instead. It is in 0.26.2.

Advisory available under CC0-1.0 license.