Hickory proto: Panic on a malformed `alpn` value when parsing SVCB or HTTPS records from text
Affects hickory-protoSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 0.26.2
Data as of 11 Nov 2026, 13:20 UTC
What to do
Upgrade hickory-proto to 0.26.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iohickory-protopkg:cargo/hickory-protoOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
When an SVCB or HTTPS record is parsed from its text (zone file) form, the `alpn` service parameter value is split into a list of protocol names. That step called `expect` on the result, on the assumption that it could not fail. A malformed value, such as one with an unbalanced quote (`alpn="h`), two commas in a row or an invalid escape, makes it fail, so the parser panicked instead of returning an error. Code that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way. The fix returns a parse error instead. It is in 0.26.2.