PT-2026-139853

CVE-2026-123572

·

Published

2026-11-08

·

Updated

2026-11-08

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-1286: Improper Validation of Syntactic Correctness of Input
Related identifiers
CVE-2026-123572
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com