Hickory DNS CVE-2026-123573

The affected system must parse an untrusted zone file (presentation format) that contains an SVCB (RR type 64) or HTTPS (RR type 65) record in which a service parameter value is replaced by only a single quote (') or double quote ("); that malformed token triggers the panic in hickory-proto's presentation-format parser. The key limiting factor is data source: only deployments that feed attacker-influenced or externally supplied zone-file data into the parser are exposed - a server that parses solely trusted, operator-authored zones is not realistically reachable despite the AV:N/PR:N vector. No authentication or user interaction is required (PR:N/UI:N) once untrusted zone data reaches the parser, and the sole impact is a crash of the parsing process (no data disclosure or modification).

The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, base 8.7) indicating a network-reachable, low-complexity, no-privilege, no-interaction flaw whose only impact is high availability loss (VA:H) with no confidentiality or integrity impact - consistent with a denial-of-service panic. The vuln.today priority Decision label is 'this_week' (not act_now/emergency). There is no CISA KEV entry, no EPSS score supplied, and no confirmed public exploit code (the two references are a GHSA vendor advisory and a VulnCheck advisory, not a working PoC), so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - high CVSS is driven entirely by the availability metric, not by any system-compromise capability - so this is a genuine but bounded DoS rather than a code-execution emergency. The most important caveat the raw CVSS score hides is the exploitation precondition: the AV:N/PR:N vector assumes the affected system actually ingests untrusted zone-file data containing SVCB/HTTPS records; deployments that parse only trusted, operator-controlled zones face substantially lower real-world risk. EPSS and KEV absence further suggest no widespread exploitation is currently observed.

An attacker who can get a hickory-dns-based system to parse an untrusted zone file (for example via a zone transfer, a secondary-zone feed, or any workflow that ingests externally supplied zone data) crafts an SVCB (type 64) or HTTPS (type 65) record in which a service parameter value is replaced by only a single quote (') or double quote ("). When hickory-proto's presentation-format parser processes this record it panics, crashing the parsing process and denying service. No public exploit code is identified at time of analysis, but the trigger is trivially reproducible from the advisory description and requires no authentication per the CVSS vector.