crates.io/hickory-proto CVE-2026-123607: unknown, EPSS 0.34%
NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
Action: Upgrade hickory-proto to 0.26.0-beta.1 or later.
cargo update -p hickory-proto --precise 0.26.0-beta.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.25.0-alpha.3 | 0.26.0-beta.1 | - |
Fixed versions
| 0.26.0-beta.1 |
Sources
- osv: RUSTSEC-2026-0118
- https://crates.io/crates/hickory-proto
- https://rustsec.org/advisories/RUSTSEC-2026-0118.html
- https://github.com/hickory-dns/hickory-dns/pull/3597
CVE-2026-123607 · published · modified · JSON