# CVE-2026-123573: hickory-dns denial of service in SVCB and HTTPS record parser

Source: https://junglewise.ai/threats/cve-2026-123573-hickory-dns-from-0-20-1-before-0-26-2-contains-a-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123573 · Severity: high · CVSS 7.5 · Published 2026-11-08

hickory-dns is a DNS protocol library used to parse DNS zone files and records. A flaw in parsing SVCB and HTTPS DNS record types causes the parser to crash (panic) when encountering malformed service parameter values containing only quotes. An attacker supplying a malicious zone file can trigger a denial of service, disrupting any application that processes untrusted DNS zone data.

Technologies: [Hickory-Dns Hickory-Proto](https://junglewise.ai/threats/technologies/hickory-dns-hickory-proto). Vendors: [Hickory-Dns](https://junglewise.ai/threats/vendors/hickory-dns).

## Quick answers

**Is CVE-2026-123573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123573 being exploited in the wild.

**How severe is CVE-2026-123573?** High severity, with a CVSS score of 7.5, published 8 November 2026.

**Which products and versions are affected?** Hickory-Dns Hickory-Proto 0.20.1 through 0.26.1.

**Is there a fix for CVE-2026-123573?** Yes: fixed in hickory-proto 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123573 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123573?** Check whether you run Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in hickory-proto 0.26.2

## Technical details

The hickory-proto component's presentation format parser for SVCB (RR type 64) and HTTPS (RR type 65) records fails to validate service parameter values and panics when a quote character appears in place of a valid parameter value. Exploitation requires the ability to provide untrusted zone file input to a system running the vulnerable versions. This is a denial of service vulnerability with no authentication or user interaction required.

## Affected products

- hickory-dns hickory-proto 0.20.1 through 0.26.1

## Timeline

- 2026-09-03: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wgfr-mphw-j5g4](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wgfr-mphw-j5g4)
- [https://www.vulncheck.com/advisories/hickory-dns-from-0.20.1-before-0.26.2-panic-in-svcb-https-zone-file-parser](https://www.vulncheck.com/advisories/hickory-dns-from-0.20.1-before-0.26.2-panic-in-svcb-https-zone-file-parser)

## Related threats

- [Hickory DNS hickory-proto denial of service in BinEncoder](https://junglewise.ai/threats/cve-2026-123608-hickory-dns-hickory-proto-from-0-3-1-before-0-26-1-contains-a)
- [Hickory DNS NSEC3 closest-encloser proof unbounded loop](https://junglewise.ai/threats/cve-2026-123607-hickory-dns-hickory-proto-0-25-0-alpha-3-through-0-25-2-and)
- [Hickory DNS DNSSEC validation bypass via RRSIG Signer's Name](https://junglewise.ai/threats/cve-2026-123605-hickory-dns-hickory-proto-0-1-through-0-25-0-alpha-3-and-hickory)
- [Hickory DNS IPv4-mapped IPv6 canonicalization bypass](https://junglewise.ai/threats/cve-2026-123603-hickory-proto-and-hickory-resolver-0-26-0-before-0-26-2-hickory)
- [Hickory DNS NSEC3 comparison operator inversion](https://junglewise.ai/threats/cve-2026-123601-hickory-dns-hickory-proto-0-25-0-through-0-26-0-alpha-1-and)