RUSTSEC-2026-0487

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0487

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0487.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0487

Aliases

CVE-2026-123572
GHSA-hx8c-fjhc-hmf5

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T09:45:02Z

Summary

Panic on a malformed `alpn` value when parsing SVCB or HTTPS records from text

Details

When an SVCB or HTTPS record is parsed from its text (zone file) form, the alpn service parameter value is split into a list of protocol names. That step called expect on the result, on the assumption that it could not fail. A malformed value, such as one with an unbalanced quote (alpn="h), two commas in a row or an invalid escape, makes it fail, so the parser panicked instead of returning an error.

Code that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.

The fix returns a parse error instead. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.20.1

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}