Reported

September 3, 2026

Issued

November 11, 2026

Package

hickory-proto (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#dns #tsig #integer-underflow #panic

Aliases

• GHSA-x962-5xwx-fr8x

References

• https://github.com/hickory-dns/hickory-dns/commit/b1246a8a21b6dcc34d427a7d39dd96e10825c384

Patched

• >=0.26.2

Unaffected

• <0.26.0

Description

When a TSIG record is decoded from the DNS wire format, its MAC length and "other data" length are checked against the end of the record data. If a check failed, the error value was built from end_idx - decoder.index(). For a malformed record the decoder can already be past end_idx, so this unsigned subtraction underflows.

In builds with overflow checks enabled (the dev profile by default) the underflow panics, so a peer that sends a crafted TSIG record can crash the process. In builds without overflow checks the result wraps and is only used in the returned error.

The fix returns a plain "insufficient bytes" error without the subtraction. It is in 0.26.2.

Advisory available under CC0-1.0 license.