https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 19:39:35 +0000 https://db.gcve.eu/vuln/rustsec-2026-0489 <p><strong>Affected:</strong> crates.io: hickory-proto</p> <p>When an SVCB or HTTPS record is parsed from its text (zone file) form, surrounding double quotes are removed from each service parameter value by checking that the value starts and ends with `&#34;` and slicing off the first and last character. A value that is a single `&#34;` (for example `alpn=&#34;`) passes that check, and the slice `[1..0]` panics.</p> <p>Code that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.</p> <p>The fix rejects a lone quote character with a parse error before the slice. It is in 0.26.2.</p> <p><strong>Affected:</strong> crates.io: hickory-proto</p> <p>When an SVCB or HTTPS record is parsed from its text (zone file) form, surrounding double quotes are removed from each service parameter value by checking that the value starts and ends with `&#34;` and slicing off the first and last character. A value that is a single `&#34;` (for example `alpn=&#34;`) passes that check, and the slice `[1..0]` panics.</p> <p>Code that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.</p> <p>The fix rejects a lone quote character with a parse error before the slice. It is in 0.26.2.</p> https://db.gcve.eu/vuln/rustsec-2026-0489