PkgSeer

Vulnerability GHSA-q2qq-hmj6-3wpp

Medium Risk

5 months ago

hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression

0.24.0 - 0.24.4 and 0.25.0 - 0.25.2 and 0.26.0

Summary

hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression

Details

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

Reporter

Qifan Zhang, Palo Alto Networks

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

0.25.0-alpha.3 - 0.25.2 GHSA-3v94-mw7p-v465

NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

0.25.0-alpha.3 - 0.26.0-alpha.1 RUSTSEC-2026-0118

CPU exhaustion during message encoding due to O(n²) name compression

0.24.0 - 0.24.4 and 0.25.0 - 0.25.2 and 0.26.0 RUSTSEC-2026-0119

Hickory DNS failure to verify self-signed RRSIG for DNSKEYs

0.24.0 - 0.24.2 and 0.25.0-alpha.1 - 0.25.0-alpha.4 GHSA-v7pc-74h8-xq2h

Hickory DNS's DNSSEC validation may accept broken authentication chains

0.24.0 - 0.24.2 GHSA-37wc-h8xc-5hc4

View all vulnerabilities for these packages

Impacted packages

hickory-proto

Timeline

Published

5 months ago

Fixed (0.26.1)

5 months ago

Last Modified

1 month ago