Most recent entries from all

fkie_cve-2026-123608

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.

GHSA-jcq8-9rwq-2c6j

msrc_CVE-2026-123608 — Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression

msrc_CVE-2026-123608

RUSTSEC-2026-0119 — CPU exhaustion during message encoding due to O(n²) name compression

Affected: crates.io: hickory-proto

During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).

We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.

UBUNTU-CVE-2026-123608

Affected: Ubuntu:24.04:LTS: rust-hickory-proto, Ubuntu:26.04:LTS: rust-hickory-proto