PT-2026-139851

CVE-2026-123570

·

Published

2026-11-08

·

Updated

2026-11-08

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-400: Uncontrolled Resource Consumption
Related identifiers
CVE-2026-123570
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com