What is GHSA-j8hx-pr94-c5mv?

GHSA-j8hx-pr94-c5mv is a security advisory published by GitHub Security Advisories with High severity. Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory...

Which CVE IDs does GHSA-j8hx-pr94-c5mv cover?

GHSA-j8hx-pr94-c5mv covers the following CVE IDs: CVE-2026-123572. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j8hx-pr94-c5mv?

GHSA-j8hx-pr94-c5mv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-j8hx-pr94-c5mvHighCVSS 7.5

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123572 →

📋 Description

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

🔗 References (4)

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5
https://nvd.nist.gov/vuln/detail/CVE-2026-123572
https://www.vulncheck.com/advisories/hickory-dns-0.20.1-before-0.26.2-panic-dos-via-svcb-https-zone-parser
https://github.com/advisories/GHSA-j8hx-pr94-c5mv