GitHub Advisoryadvisory · crates.io

GHSA-q2qq-hmj6-3wpp hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression

MEDIUM Published 2026-05-07 Modified 2026-05-07 Official page ↗
Ecosystem
crates.io
Packages
hickory-proto
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-407, CWE-770
Reviewed
2026-05-07

Affected packages

• crates.io hickory-proto: >= 0.3.1, < 0.26.1 → fixed in 0.26.1

Description

During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec)>`. The name compression logic then searches for matches with a linear scan. A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks. This is similar to CVE-2024-8508. Reporter Qifan Zhang, Palo Alto Networks

Related

Weakness · CWE (2)

  • CWE-407 Inefficient Algorithmic Complexity weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References