CVE-2026-123574

Description

The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: HIGH
CVSS score: 8.7 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Effective score: 8.7 / 10 HIGH source: CNA overview
CWE(s): CWE-20
Reserved: 2026-11-06
Published: 2026-11-08 01:38 UTC
Last updated: 2026-11-08 01:38 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123574.json
Linked Threat: CVE-2026-123574 — Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119333

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
hickory-dns	hickory-dns	`0.24.0` (affected), `0.26.2` (unaffected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

GitHub Security Advisory (GHSA-4rph-pmrw-mwpw) vendor-advisory
VulnCheck Advisory: Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVEs and Security Vulnerabilities - OpenCVE

web:app.opencve.io

Explore the latest vulnerabilities and security issues in the CVE database

2026-11-08 10:23 UTC
September 2026 Patch Tuesday — Complete CVE Reference

web:endpointweekly.com

All 633 CVEs from September 2026 Patch Tuesday — searchable, filterable, with plain-English IT admin notes on every vulnerability. Includes CVE - 2026 -81963, the exploited Windows Update Stack EoP, and the five CVEs KB5124008 does not fix .

2026-11-08 10:23 UTC
CVE-2026-123574: hickory-dns · Improper Input Validation

web:radar.offseq.com

CVE-2026-123574 is a high-severity vulnerability in the hickory-proto crate of Hickory DNS versions 0.24.0 up to but not including 0.26.2. The zone file parser improperly handles tokens of 4096 bytes or longer, causing the parser to panic.

2026-11-08 10:23 UTC
Cisco Meraki Security Hardening Release: October 2026

web:sec.cloudapps.cisco.com

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching ...

2026-11-08 10:23 UTC
ArcGIS Server Security 2026 Update 4 Patch - Esri Support

web:support.esri.com

The issues resolved by these patches are listed in the Issues addressed with this patch section below. As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and ...

2026-11-08 10:23 UTC
[Security Advisory] September 2026 CVE Advisory Notification

web:support.servicenow.com

What you need to know: On September 24, 2026 , ServiceNow issued CVE - 2026 -86857, CVE - 2026 -86858, CVE - 2026 -13016, CVE - 2026 -86859, and CVE - 2026 -86860. Each of these security issues was identified through internal security testing, customer security assessments, or reports submitted through ServiceNow's responsible disclosure and bug bounty programs and was remediated independently. For security ...

2026-11-08 10:23 UTC
CVE-2026-123574 - Denial of Service in Hickory DNS 0.24.0…

web:vulmon.com

Vulnerability Summary Hickory DNS versions 0.24.0 through 0.26.1 are vulnerable to denial of service. An attacker providing an untrusted zone file can cause a panic by including a single token of 4096 bytes or more. This vulnerability affects the zone file parser within the hickory-proto crate. Subscribe to Hickory-dns

2026-11-08 10:23 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.

2026-11-08 10:23 UTC
The 8 Best Automated Vulnerability Remediation Tools in 2026

web:www.openhands.dev

Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.

2026-11-08 10:23 UTC
CVE-2026-117574: Vulnerability Details - Analysis & Fix | TheHackerWire

web:www.thehackerwire.com

How do I fix or mitigate CVE - 2026 -117574? To protect against CVE - 2026 -117574, you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-11-08 10:23 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-123574.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/hickory-proto",
          "product": "hickory-dns",
          "vendor": "hickory-dns",
          "versions": [
            {
              "lessThan": "0.26.2",
              "status": "affected",
              "version": "0.24.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.26.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "kirk-baird"
        }
      ],
      "datePublic": "2026-09-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:10.613Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4rph-pmrw-mwpw)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw"
        },
        {
          "name": "VulnCheck Advisory: Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hickory-dns-0.24.0-before-0.26.2-denial-of-service-via-zone-file-parser"
        }
      ],
      "title": "Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123574",
    "datePublished": "2026-11-08T01:38:10.613Z",
    "dateReserved": "2026-11-06T00:53:14.313Z",
    "dateUpdated": "2026-11-08T01:38:10.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}