A vulnerability in the Hickory proto zone file lexer causes a panic when processing a token of 4096 or more characters. This occurs because the lexer used a loop capped at 4096 iterations with an assertion to enforce this limit. If a token reaches this length, the assertion triggers a panic, causing a denial of service when parsing zone files from untrusted sources. The issue is fixed in version 0.26.2 by removing the iteration bound so the lexer ends correctly on token completion or error.