Vulnerability-Lookup

rustsec-2026-0119

Vulnerability from osv_rustsec

Published

2026-05-01 12:00

Modified

2026-05-01 14:31

Summary

CPU exhaustion during message encoding due to O(n²) name compression

Details

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.

References

URL

Type

	https://crates.io/crates/hickory-proto	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0119.html	ADVISORY
	https://github.com/hickory-dns/hickory-dns/securi…	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "hickory-proto",
        "purl": "pkg:cargo/hickory-proto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.1"
            },
            {
              "fixed": "0.26.1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC-BY-4.0"
  },
  "details": "During message encoding, `hickory-proto`\u0027s `BinEncoder` stores pointers to\nlabels that are candidates for name compression in a `Vec\u003c(usize, Vec\u003cu8\u003e)\u003e`.\nThe name compression logic then searches for matches with a linear scan.\n\nA malicious message with many records can both introduce many candidate labels,\nand invoke this linear scan many times. This can amplify CPU exhaustion in DoS\nattacks.\n\nThis is similar to\n[CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).\n\nWe recommend all affected users update to `hickory-proto` 0.26.1 for the fix.",
  "id": "RUSTSEC-2026-0119",
  "modified": "2026-05-01T14:31:54Z",
  "published": "2026-05-01T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/hickory-proto"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0119.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp"
    }
  ],
  "related": [
    "CVE-2024-8508"
  ],
  "severity": [],
  "summary": "CPU exhaustion during message encoding due to O(n\u00b2) name compression"
}

CVE-2024-8508 (GCVE-0-2024-8508)

Vulnerability from cvelistv5 – Published: 2024-10-03 16:27 – Updated: 2024-11-14 21:02

Title

Unbounded name compression could lead to Denial of Service

Summary

NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-606 - Unchecked Input for Loop Condition

Assigner

NLnet Labs

References

URL

Tags

https://www.nlnetlabs.nl/downloads/unbound/CVE-20…

vendor-advisory

Impacted products

	Vendor	Product	Version
	NLnet Labs	Unbound	Affected: 0 , ≤ 1.21.0 (semver)

Date Public ?

2024-10-03 00:00

Credits

Toshifumi Sakaguchi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unbound",
            "vendor": "nlnetlabs",
            "versions": [
              {
                "lessThanOrEqual": "1.21.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8508",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-03T17:11:45.971377Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-03T17:15:19.533Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-11-14T21:02:40.473Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/10/04/5"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Unbound",
          "vendor": "NLnet Labs",
          "versions": [
            {
              "lessThanOrEqual": "1.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Toshifumi Sakaguchi"
        }
      ],
      "datePublic": "2024-10-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-606",
              "description": "CWE-606: Unchecked Input for Loop Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-03T16:27:54.540Z",
        "orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
        "shortName": "NLnet Labs"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed in 1.21.1 and all later versions."
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-25T00:00:00.000Z",
          "value": "Issue reported by Toshifumi Sakaguchi"
        },
        {
          "lang": "en",
          "time": "2024-07-31T00:00:00.000Z",
          "value": "Issue acknowledged by NLnet Labs; mitigation shared with Toshifumi Sakaguchi"
        },
        {
          "lang": "en",
          "time": "2024-08-01T00:00:00.000Z",
          "value": "Mitigation confirmed by Toshifumi Sakaguchi"
        },
        {
          "lang": "en",
          "time": "2024-10-03T00:00:00.000Z",
          "value": "Fixes released with Unbound 1.21.1"
        }
      ],
      "title": "Unbounded name compression could lead to Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
    "assignerShortName": "NLnet Labs",
    "cveId": "CVE-2024-8508",
    "datePublished": "2024-10-03T16:27:54.540Z",
    "dateReserved": "2024-09-06T11:47:59.783Z",
    "dateUpdated": "2024-11-14T21:02:40.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted