EUVD-2026-119333
GHSA-29xw-595w-jfj7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted zone file to parser
-
ExploitInclude token ≥4096 bytes
-
ExecutionTrigger parser panic
-
ImpactCrash service (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the application using hickory-proto actually parses zone files originating from an untrusted source - the specific trigger is a single zone-file token that is 4096 bytes or longer, which causes the parser to panic. The limiting factor is the data path, not authentication: although CVSS is PR:N/UI:N/AV:N, the vulnerability is only reachable if attacker-controlled zone-file input reaches the parser. Deployments that only parse operator-controlled or trusted zone files are not exposed. Affected versions are hickory-proto 0.24.0 up to and including 0.26.1; it is fixed in 0.26.2, and updating to 0.26.2 is the remediation the advisory provides. |
| Impact | This is a denial-of-service vulnerability (CWE-20) in the hickory-proto zone file parser, scored CVSS 4.0 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H - network-reachable, low complexity, no privileges, no user interaction, and impacting only availability (VC:N/VI:N) with high availability loss (VA:H). No EPSS probability, CISA KEV listing, or SSVC automatable/exploitation values were supplied, so the only quantitative priority signal is the vuln.today Decision label 'this_week', which indicates meaningful but not emergency urgency. The CVSS AV:N and PR:N describe severity, not the real-world reachability: exploitation depends entirely on whether the embedding application actually feeds attacker-supplied zone files to the parser, so the network/unauthenticated rating is only realized in deployments that accept untrusted zone files. The impact is confined to availability (a panic/crash) with no confidentiality or integrity effect, so despite the High score this is a crash-class DoS rather than a code-execution or data-exposure issue; treat it as a this-week patch priority for services that parse untrusted zone data, and lower priority where zone files are fully trusted/operator-controlled. |
| Exploit ScenarioDerived | An application built on hickory-proto (e.g. a secondary/DNS tooling service) accepts a zone file from an untrusted source and passes it to the zone file parser. The attacker submits a zone file containing a single token of 4096 bytes or more, causing the parser to panic and crash the thread or process, producing a denial of service. A vendor security advisory (GHSA-4rph-pmrw-mwpw) describes the flaw, but the referenced material is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 08, 2026
Denial of service in the Hickory DNS hickory-proto zone file parser: parsing a zone file containing a single token of 4096 bytes or longer causes the parser to panic. Affected releases are hickory-proto 0.24.0 through 0.26.1; exposure is limited to applications that actually parse zone files from an untrusted source, while deployments that only parse operator-controlled zone files are not reachable through this path. The vendor advisory provides the fix in 0.26.2, and no public exploit code was identified at time of analysis.
RemediationAI
Upgrade hickory-proto to 0.26.2, the version named as fixed in the GitHub advisory GHSA-4rph-pmrw-mwpw (https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw); for Rust projects this means bumping the hickory-proto dependency constraint to 0.26.2 or later and rebuilding, taking care that transitive consumers of the crate in the 0.24.0-0.26.1 range are also updated. Because the trigger is a single zone-file token of 4096 bytes or longer, an interim control is to stop passing zone files from untrusted sources into the parser - only parse operator-controlled or otherwise trusted zone files, and treat zone-file ingestion endpoints as trusted-input-only until the dependency is updated (the trade-off is loss of functionality wherever untrusted zone ingestion is a deliberate feature). The advisory names updating to 0.26.2 as the remediation it provides, so patching should be the primary action; given the this_week priority assigned by vuln.today and the network-reachable, no-privilege, no-interaction profile of the CVSS vector, schedule the dependency bump in the current patch cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the zone file parser shipped in the Rust hickory-proto crate, part of the Hickory DNS project (CPE cpe:2.3:a:hickory-dns:hickory-dns). It is classified as CWE-20 (improper input validation): the parser does not bound the length of an individual zone-file token, so a token of 4096 bytes or more drives it into a panic rather than returning a parse error. Because the failure is a panic inside the parsing routine, the practical consequence depends on how the consuming application handles panics - at minimum the parse operation aborts, and any application that treats the parser as infallible on attacker-supplied input can lose availability. The advisory does not describe the internal code path or allocation behaviour beyond the 4096-byte token threshold, so the exact mechanism of the panic is not detailed in the available sources. Scoring is CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H), and the independent assessment records CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - integrity and confidentiality are unaffected in both, with impact confined to availability. The reachability constraint is the data path rather than authentication or user interaction: an attacker must be able to get a crafted zone file, or a zone file containing an oversized token, into an application that runs the parser.
Know when Hickory Dns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable parser with no privileges or interaction and low complexity, impacting only availability via a panic, so C:N/I:N/A:H with scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.
Technical POC Analysis
Evidence basis: GHSA-4rph-pmrw-mwpw (published 2026-09-03, reporter kirk-baird).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A denial-of-service flaw in the Hickory DNS hickory-proto library can crash applications that parse externally supplied zone files, with a CVSS score of 8.7. Leadership attention is warranted only if product or platform teams embed this library and ingest zone files from customers, partners, or other untrusted sources; internal operators using their own trusted zone files face no reachable risk through this path.
Vendor-released patch: 0.26.2. Until applied, restrict zone file parsing to operator-controlled inputs, enforce token length limits before parsing, and isolate the parser in a bounded process so a panic cannot degrade the surrounding service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Hickory DNS Multiple Security Flaws
View all 36More in Hickory Dns
View allMalformed TSIG records can crash Hickory DNS 0.26.0 through 0.26.1 builds compiled with overflow checks enabled, causing
Remote, unauthenticated memory-amplification denial of service affects Hickory DNS (the hickory-proto crate) versions 0.
Exploit-DB