Hickory proto: Zone file lexer panics on a token of 4096 or more characters
Affects hickory-protoSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 0.26.2
Data as of 11 Nov 2026, 13:20 UTC
What to do
Upgrade hickory-proto to 0.26.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iohickory-protopkg:cargo/hickory-protoOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The zone file lexer read each token in a loop capped at 4,096 iterations, with an `assert!` on the loop counter as a safety bound. A single token long enough to reach that bound, for example a very long name or character string in a zone file, triggered the assertion and the parser panicked instead of returning the token or an error. Code that parses zone files from an untrusted source can be made to panic, which is a denial of service. The fix removes the iteration bound, so the lexer ends only when it reaches the end of a token or an error. It is in 0.26.2.