Hickory DNS EUVD-2026-119456

The decisive limiting condition, stated by the GHSA advisory, is build configuration: the underflow only panics in binaries compiled with overflow checks enabled (the Rust dev profile, or release builds with overflow-checks/debug-assertions turned on). Default Rust release builds have overflow checks off, so the subtraction wraps without crashing and the denial of service does not occur. Beyond that, exploitation requires no authentication (PR:N), no user interaction (UI:N), and only the ability to deliver a crafted TSIG record in DNS wire format to a service parsing untrusted DNS messages with vulnerable hickory-proto 0.26.0-0.26.1; the single complete fix is updating to 0.26.2.

Signals conflict on real-world severity. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity trigger with high availability impact (VA:H) and no confidentiality or integrity impact - consistent with a pure denial-of-service via panic. However, the GHSA advisory materially constrains this: the arithmetic underflow only panics 'when compiling with the dev profile' / with overflow checks enabled. Rust release builds disable overflow checks by default, where the subtraction would wrap silently rather than crash, so the VA:H impact does not apply to typical production binaries unless the operator explicitly enabled overflow-checks/debug-assertions. The vuln.today Decision label is 'this_week' (not act_now or emergency), there is no CISA KEV listing, no EPSS score was provided, and no public exploit was identified - collectively indicating a credible but non-emergency issue. Net: a genuinely high CVSS-scored DoS whose realistic blast radius depends on build configuration; prioritize patching for anyone running debug/overflow-checked builds, treat it as lower urgency for standard release deployments.

A remote, unauthenticated attacker sends a single crafted TSIG resource record in DNS wire format to a service built on vulnerable hickory-proto (0.26.0-0.26.1), causing an unchecked subtraction to underflow during RDATA decoding. On a binary compiled with overflow checks enabled, this triggers an immediate panic that crashes the process, producing denial of service; the low attack complexity (AC:L) means no special timing or grooming is required. No public exploit code was identified, though the trigger is a simple malformed record.