{"id":"AZL-113197","summary":"CVE-2026-123570 affecting package netavark 1.10.3-9","details":"The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.","modified":"2026-11-14T05:30:17Z","published":"2026-11-08T02:16:49Z","upstream":["CVE-2026-123570"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123570"}],"affected":[{"package":{"name":"netavark","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/netavark"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.3-9"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113197.json"}}],"schema_version":"1.9.2"}