Reported

September 3, 2026

Issued

November 11, 2026

Package

hickory-proto (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#dns #zone-file #lexer #panic

Aliases

• GHSA-4rph-pmrw-mwpw

References

• https://github.com/hickory-dns/hickory-dns/commit/0494e15c88fba612f9ecb4f013eb3b221822c867

Patched

• >=0.26.2

Unaffected

• <0.24.0

Description

The zone file lexer read each token in a loop capped at 4,096 iterations, with an assert! on the loop counter as a safety bound. A single token long enough to reach that bound, for example a very long name or character string in a zone file, triggered the assertion and the parser panicked instead of returning the token or an error.

Code that parses zone files from an untrusted source can be made to panic, which is a denial of service.

The fix removes the iteration bound, so the lexer ends only when it reaches the end of a token or an error. It is in 0.26.2.

Advisory available under CC0-1.0 license.