CVE-2026-123572

7.5 HIGHpublic exploit available

Published 2026-11-08 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-1286

Public exploit & PoC references

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5

All references

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5
https://www.vulncheck.com/advisories/hickory-dns-0.20.1-before-0.26.2-panic-dos-via-svcb-https-zone-parser

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-0931
MEDIUMCVE-2026-100902PoC
HIGHCVE-2026-102084
UNSCOREDCVE-2026-105660PoC
MEDIUMCVE-2026-109425PoC
UNSCOREDCVE-2026-110675PoC
CRITICALCVE-2026-110759PoC
UNSCOREDCVE-2026-111107

Related by shared AI tags and CWE weakness class. Browse the full archive.