# CVE-2026-123574: Hickory DNS zone file parser panic on long tokens

Source: https://junglewise.ai/threats/cve-2026-123574-the-zone-file-parser-in-the-hickory-proto-crate-of-hickory-dns-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123574 · Severity: high · CVSS 7.5 · Published 2026-11-08

Hickory DNS is a DNS server implementation used to parse and manage DNS zone files. When processing an untrusted zone file containing a single token (data element) of 4096 bytes or longer, the parser crashes, causing a denial of service. Applications that accept zone files from untrusted sources face risk of service disruption through a single malformed file.

Technologies: [Hickory-Dns Hickory-Proto](https://junglewise.ai/threats/technologies/hickory-dns-hickory-proto). Vendors: [Hickory-Dns](https://junglewise.ai/threats/vendors/hickory-dns).

## Quick answers

**Is CVE-2026-123574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123574 being exploited in the wild.

**How severe is CVE-2026-123574?** High severity, with a CVSS score of 7.5, published 8 November 2026.

**Which products and versions are affected?** Hickory-Dns Hickory-Proto 0.24.0 to 0.26.1.

**Is there a fix for CVE-2026-123574?** Yes: fixed in hickory-proto 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123574 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123574?** Check whether you run Hickory-Dns Hickory-Proto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in hickory-proto 0.26.2

## Technical details

The hickory-proto crate's zone file parser contains an improper input validation flaw that causes an unhandled panic when encountering a token of 4096 bytes or longer. The vulnerability affects versions 0.24.0 through 0.26.1 and requires only network access to supply an untrusted zone file; no authentication or user interaction is required. An attacker can trigger a denial of service by crafting a malicious zone file, and the flaw is addressed in version 0.26.2.

## Affected products

- Hickory DNS hickory-proto 0.24.0 to 0.26.1

## Timeline

- 2026-09-03: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw)
- [https://www.vulncheck.com/advisories/hickory-dns-0.24.0-before-0.26.2-denial-of-service-via-zone-file-parser](https://www.vulncheck.com/advisories/hickory-dns-0.24.0-before-0.26.2-denial-of-service-via-zone-file-parser)

## Related threats

- [Hickory DNS hickory-proto denial of service in BinEncoder](https://junglewise.ai/threats/cve-2026-123608-hickory-dns-hickory-proto-from-0-3-1-before-0-26-1-contains-a)
- [Hickory DNS NSEC3 closest-encloser proof unbounded loop](https://junglewise.ai/threats/cve-2026-123607-hickory-dns-hickory-proto-0-25-0-alpha-3-through-0-25-2-and)
- [Hickory DNS DNSSEC validation bypass via RRSIG Signer's Name](https://junglewise.ai/threats/cve-2026-123605-hickory-dns-hickory-proto-0-1-through-0-25-0-alpha-3-and-hickory)
- [Hickory DNS IPv4-mapped IPv6 canonicalization bypass](https://junglewise.ai/threats/cve-2026-123603-hickory-proto-and-hickory-resolver-0-26-0-before-0-26-2-hickory)
- [Hickory DNS NSEC3 comparison operator inversion](https://junglewise.ai/threats/cve-2026-123601-hickory-dns-hickory-proto-0-25-0-through-0-26-0-alpha-1-and)