High priorityDisclosed

Advisory · CVE-2026-123570

Hickory DNS preallocates huge buffers from untrusted DNS counts

The DNS wire-format message parser in hickory-proto 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data, letting remote attackers send a UDP datagram or spoofed response with counts set to 65535 to force about 18MB of allocation per message, rated high at CVSS 8.7 under version 4.0; fixed in 0.26.2.

Advisory published November 8, 2026Independent summary
Vendor
hickory-dns
Product
Hickory DNS
Identifier / CWE
CVE-2026-123570
CWE-400
Action timing
Immediate
ELI5

Explain it like I’m five

A DNS message starts with a header saying how many records follow. Hickory sets aside memory for all of them before checking whether they actually exist, so a tiny message claiming 65,535 records makes it reserve about 18 megabytes.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Datagram crafted

    An attacker sends a UDP datagram, or a spoofed response to a client or resolver, with the record counts set to 65535.

  2. 02Vectors preallocated

    Record vectors are sized from the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before record data is read.

  3. 03Memory amplified

    About 18MB is allocated per message from a small datagram.

  4. 04Service degraded

    Repeated messages exhaust resolver memory and stall DNS service.

What happened

The DNS wire-format message parser in hickory-proto 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client or resolver, with these counts set to 65535, forcing about 18MB of allocation per message. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.

This is one of several denial-of-service flaws in Hickory DNS fixed in 0.26.2, and the most broadly reachable: any remote sender can trigger it with a single UDP datagram. The flaw is fixed in 0.26.2.

What to do

  1. Inventory applications and services using Hickory DNS crates and record each version.
  2. Upgrade hickory-proto to 0.26.2 or later.
  3. Monitor resolver memory use and watch for allocation spikes from small datagrams.
  4. Restrict which sources can reach the resolver where the deployment allows it.
  5. Verify the deployed crate versions after updating.

Management note

Memory amplification over UDP is the cheapest denial of service there is: one small packet, 18 megabytes. Upgrade the parser library rather than trying to filter the traffic.