RUSTSEC-2026-0489

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0489

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0489.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0489

Aliases

CVE-2026-123573
GHSA-wgfr-mphw-j5g4

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T09:45:02Z

Summary

Panic when an SVCB or HTTPS parameter value is a single quote character

Details

When an SVCB or HTTPS record is parsed from its text (zone file) form, surrounding double quotes are removed from each service parameter value by checking that the value starts and ends with " and slicing off the first and last character. A value that is a single " (for example alpn=") passes that check, and the slice [1..0] panics.

Code that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.

The fix rejects a lone quote character with a parse error before the slice. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.20.1

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}