RUSTSEC-2026-0490

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0490

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0490.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0490

Aliases

CVE-2026-123574
GHSA-4rph-pmrw-mwpw

Published

2026-09-03T12:00:00Z

Modified

2026-11-11T12:41:09Z

Summary

Zone file lexer panics on a token of 4096 or more characters

Details

The zone file lexer read each token in a loop capped at 4,096 iterations, with an assert! on the loop counter as a safety bound. A single token long enough to reach that bound, for example a very long name or character string in a zone file, triggered the assertion and the parser panicked instead of returning the token or an error.

Code that parses zone files from an untrusted source can be made to panic, which is a denial of service.

The fix removes the iteration bound, so the lexer ends only when it reaches the end of a token or an error. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.24.0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}