# NLnetLabs domain DNS library panics and resource exhaustion

Source: https://junglewise.ai/threats/rustsec-2026-0310-various-panics-soundness-and-resource-exhaustion-e61b68e0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-09-25

The domain Rust library, used for DNS protocol handling, contains multiple bugs that can cause application crashes, memory exhaustion, and CPU exhaustion when processing specially crafted DNS messages. An attacker sending malicious DNS messages or zone data can trigger these issues remotely, potentially disrupting DNS resolution services or consuming excessive server resources.

Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Nlnetlabs](https://junglewise.ai/threats/vendors/nlnetlabs).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** domain (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.12.3; Nlnetlabs Domain before 0.12.3.

**Is there a fix for This vulnerability?** Yes. domain (crates.io): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run domain (crates.io) or Nlnetlabs Domain at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- domain (crates.io): upgrade to 0.12.3 or later

  ```sh
  cargo update -p domain
  ```


## Technical details

Multiple denial-of-service vulnerabilities across DNS message parsing, zone file parsing, and resolver components. Issues include unbounded compression pointer chains, unbounded CNAME chain following, integer overflows (u16::MAX in ANCOUNT), insufficient length validation on record data, and unguarded panics in resolver and transport code triggered by malicious incoming DNS packets or zone updates.

## Affected products

- NLnetLabs domain before 0.12.3

## Timeline

- 2026-09-25: disclosed

## References

- [https://crates.io/crates/domain](https://crates.io/crates/domain)
- [https://rustsec.org/advisories/RUSTSEC-2026-0310.html](https://rustsec.org/advisories/RUSTSEC-2026-0310.html)