PkgSeer

Vulnerability RUSTSEC-2026-0119

Unknown

5 months ago

CPU exhaustion during message encoding due to O(n²) name compression

0.24.0 - 0.24.4 and 0.25.0 - 0.25.2 and 0.26.0

Summary

CPU exhaustion during message encoding due to O(n²) name compression

Details

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression

0.24.0 - 0.24.4 and 0.25.0 - 0.25.2 and 0.26.0 GHSA-q2qq-hmj6-3wpp

hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

0.25.0-alpha.3 - 0.25.2 GHSA-3v94-mw7p-v465

NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

0.25.0-alpha.3 - 0.26.0-alpha.1 RUSTSEC-2026-0118

Hickory DNS failure to verify self-signed RRSIG for DNSKEYs

0.24.0 - 0.24.2 and 0.25.0-alpha.1 - 0.25.0-alpha.4 GHSA-v7pc-74h8-xq2h

Hickory DNS's DNSSEC validation may accept broken authentication chains

0.24.0 - 0.24.2 GHSA-37wc-h8xc-5hc4

View all vulnerabilities for these packages

Impacted packages

hickory-proto

Timeline

Published

5 months ago

Fixed (0.26.1)

5 months ago

Last Modified

1 hour ago