Hickory DNS Parser Denial of Service Flaws

Malformed TSIG records can crash Hickory DNS 0.26.0 through 0.26.1 builds compiled with overflow checks enabled, causing a denial of service. The flaw is an unchecked subtraction in TSIG RDATA decoding (CWE-191) reachable by unauthenticated remote attackers who can deliver crafted DNS wire-format messages; default Rust release builds have overflow checks off, so the subtraction wraps and the panic does not occur. The assessed CVSS 8.7 reflects high availability impact, but the crash is conditional on build configuration, and no public exploit identified at time of analysis.

Denial of service in the Rust hickory-proto crate (versions 0.20.1 through 0.26.1) occurs when its presentation-format SVCB (RR type 64) or HTTPS (RR type 65) record parser encounters a malformed alpn service parameter - unbalanced quotes, two consecutive commas, or invalid escape sequences - and panics instead of returning a parse error. Any service that feeds untrusted or attacker-influenced zone-file text into this parser can be crashed, producing a high availability impact (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/A:H) with no confidentiality or integrity effect and no authentication or user interaction required at the parser. Exposure is bounded: deployments that only handle wire-format DNS data, or that parse solely operator-controlled zone files, never reach the vulnerable code path; no public exploit code or active exploitation was identified at time of analysis, and the issue is prioritised for remediation this week rather than as an emergency.

Remote, unauthenticated memory-amplification denial of service affects Hickory DNS (the hickory-proto crate) versions 0.18 through 0.26.1: a single crafted UDP DNS message whose header sets ANCOUNT, NSCOUNT and ARCOUNT to 65535 causes the wire-format parser to reserve about 18 MB for record vectors before parsing fails. The same code path is reachable in server mode from any UDP datagram and in client/resolver mode from a spoofed response, though each message produces only a transient allocation, so sustained unavailability requires a stream of packets rather than one. No public exploit code was identified at time of analysis, and the vendor has released hickory-proto 0.26.2 as the fix.