CVE-2026-123574

Public on 2026-11-08
Modified on 2026-11-12
Description
The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.2
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2023 aardvark-dns Pending Fix
Amazon Linux 2027 Preview aardvark-dns Pending Fix
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra aws-nitro-enclaves-cli Pending Fix
Amazon Linux 2023 aws-nitro-enclaves-cli Pending Fix
Amazon Linux 2027 Preview aws-nitro-enclaves-cli Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-123574 Mitre: CVE-2026-123574