{"id":"CVE-2026-123570","aliases":["RUSTSEC-2026-0491","GHSA-67wc-6jq8-ghrc"],"title":"Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts","titleSource":"VulnCheck","descriptionSource":"OSV","description":"When a DNS message is decoded, the vectors for the question, answer, authority and additional sections were created with `Vec::with_capacity` set to the counts in the message header. Those counts come from the sender and are not checked against the size of the message, so a single small packet that claims 65,535 records makes the decoder reserve memory for that many records (about 18 MB, according to the upstream advisory) before it reads any record and fails.\n\nAny code that decodes untrusted DNS messages is exposed. That includes servers, and clients and resolvers that receive spoofed responses. Repeated packets can drive memory use up and cause a denial of service.\n\nThe fix caps the initial capacity at 8 entries and lets the vectors grow as records are actually decoded. It is in 0.26.2.","severity":"high","score":8.7,"published":"2026-09-03T12:00:00.000Z","modified":"2026-11-12T09:45:02.494Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"crates.io","name":"hickory-proto","sources":[{"name":"OSV · RUSTSEC-2026-0491","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0491"}],"ranges":[{"events":[{"introduced":"0.18.0"},{"fixed":"0.26.2"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.2"]}],"sourceAffected":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc","https://www.vulncheck.com/advisories/hickory-dns-from-0.18-before-0.26.2-memory-amplification-dos-via-rr-counts","https://crates.io/crates/hickory-proto","https://rustsec.org/advisories/RUSTSEC-2026-0491.html","https://github.com/hickory-dns/hickory-dns/commit/280c0e5c4e3002d73ba0762835ef82272d1d33a6"],"sources":[{"name":"CVE","id":"CVE-2026-123570","modified":"2026-11-09T13:55:57.344Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123570"},{"name":"OSV","id":"RUSTSEC-2026-0491","modified":"2026-11-12T09:45:02.494262633Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0491"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"cve":{"records":[{"id":"CVE-2026-123570","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:53:14.313Z","published":"2026-11-08T01:38:07.919Z","modified":"2026-11-09T13:55:57.344Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:07.919Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:55:57.344Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-from-0.18-before-0.26.2-memory-amplification-dos-via-rr-counts","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-400","description":"Uncontrolled Resource Consumption","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:55:49.382736Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.18","status":"affected","lessThan":"0.26.2","versionType":"custom"},{"version":"0.26.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-proto","packageIdentity":{"ecosystem":"crates.io","name":"hickory-proto"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123570"}],"remediation":[],"observedAt":"2026-11-12T13:14:25.416Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:45:32.170Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T02:50:31.024Z","attemptedAt":"2026-11-08T02:50:31.024Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:50:30.769Z","attemptedAt":"2026-11-08T02:50:30.769Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:50:31.024Z","attemptedAt":"2026-11-08T02:50:31.024Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:50:31.024Z","attemptedAt":"2026-11-08T02:50:31.024Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-123570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123570","modified":"2026-11-08T02:16:49.830","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T02:50:31.024Z"},{"source":"NVD","id":"CVE-2026-123570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123570","modified":"2026-11-08T02:16:49.830","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-08T02:50:31.024Z"}],"aiSummary":{"text":"Hickory DNS versions 0.18 before 0.26.2 are vulnerable to a memory amplification denial-of-service (DoS) via RR counts. An attacker with access to send DNS messages can cause memory consumption. The weakness is uncontrolled resource consumption.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T13:16:05.397Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123570"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0491"}]}}