hickory-proto CVE-2026-123572

Exploitation requires that the deployed application feed untrusted or attacker-influenced DNS zone data in presentation (text) format to hickory-proto's SVCB (RR type 64) / HTTPS (RR type 65) record parser, where the malicious record carries a malformed alpn service parameter (unbalanced quotes, consecutive commas, or invalid escapes). No authentication or user interaction is needed at the parser (PR:N/UI:N). The principal limiting factor is exposure of that code path: deployments that only process wire-format DNS responses, or that parse only trusted/operator-controlled zone files, do not reach this presentation-format parser and are not exploitable. Affected versions are 0.20.1 through 0.26.1 only; 0.26.2 and later are fixed.

This is a genuine but bounded availability risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores it 8.7 (High) with impact confined entirely to availability (VA:H; VC:N/VI:N/VA... integrity and confidentiality N) - a process panic/crash, consistent with CWE-1286 (improper syntactic validation) and the advisory's description of a parser panic. There is no KEV listing and no EPSS value supplied, so there is no signal of active or probabilistic exploitation; the vuln.today decision label is 'this_week', indicating prompt-but-not-crisis prioritization. The key caveat is that the AV:N/PR:N rating assumes the attacker can reach the vulnerable presentation-format (zone file) parser with untrusted input - a condition that is NOT universal: many hickory-proto deployments only parse wire-format DNS or operator-controlled zone files and are therefore not exposed. So the raw High score overstates risk for deployments that do not ingest untrusted zone-file text, and matches it for services that do (e.g. multi-tenant or user-supplied zone ingestion). Net: a real priority to patch for exposed deployments, lower real-world risk than the score suggests for everyone else.

An application built on hickory-proto parses a user- or tenant-supplied DNS zone file in presentation format; an attacker submits a zone containing an SVCB or HTTPS record whose alpn parameter has unbalanced quotes, two consecutive commas, or an invalid escape. The parser panics instead of returning an error, crashing the parsing thread or process and denying service. No public working exploit code was identified in the provided sources, but the advisory describes the triggering inputs in enough detail to reproduce; exploitation needs no authentication or user interaction once attacker-controlled zone text reaches the parser.