AZL-113197
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113197.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-113197
- Upstream
- Published
- 2026-11-08T02:16:49Z
- Modified
- 2026-11-14T05:30:17Z
- Summary
- CVE-2026-123570 affecting package netavark 1.10.3-9
- Details
-
The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.
- References