https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T23:13:23.377966+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-123608 fkie_cve-2026-123608 2026-11-11T23:13:23.380495+00:00

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.

 https://db.gcve.eu/vuln/ghsa-jcq8-9rwq-2c6j GHSA-jcq8-9rwq-2c6j 2026-11-11T23:13:23.380551+00:00

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.

 https://db.gcve.eu/vuln/msrc_cve-2026-123608 msrc_CVE-2026-123608 — Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression 2026-11-11T23:13:23.380571+00:00 msrc_CVE-2026-123608 https://db.gcve.eu/vuln/rustsec-2026-0119 RUSTSEC-2026-0119 — CPU exhaustion during message encoding due to O(n²) name compression 2026-11-11T23:13:23.380590+00:00

Affected: crates.io: hickory-proto

During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).

We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-123608 UBUNTU-CVE-2026-123608 2026-11-11T23:13:23.380619+00:00

Affected: Ubuntu:24.04:LTS: rust-hickory-proto, Ubuntu:26.04:LTS: rust-hickory-proto

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.