{"id":"RUSTSEC-2026-0119","aliases":["GHSA-q2qq-hmj6-3wpp"],"title":"CPU exhaustion during message encoding due to O(n²) name compression","summary":"CPU exhaustion during message encoding due to O(n²) name compression","severity":"none","vendor":"hickory-proto","product":"hickory-proto","ecosystem":"rust","affected":["hickory-proto >= 0.3.1, < 0.26.1"],"patched":["hickory-proto 0.26.1"],"published":"2026-05-01","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:13.569223841Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0119","references":[{"url":"https://crates.io/crates/hickory-proto"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0119.html"},{"url":"https://github.com/hickory-dns/hickory-dns/pull/3613"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.191Z","slug":"RUSTSEC-2026-0119","body":"## Overview\n\nDuring message encoding, `hickory-proto`'s `BinEncoder` stores pointers to\nlabels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`.\nThe name compression logic then searches for matches with a linear scan.\n\nA malicious message with many records can both introduce many candidate labels,\nand invoke this linear scan many times. This can amplify CPU exhaustion in DoS\nattacks.\n\nThis is similar to\n[CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).\n\nWe recommend all affected users update to `hickory-proto` 0.26.1 for the fix.\n\n## Affected packages\n\n- `hickory-proto >= 0.3.1, < 0.26.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `hickory-proto 0.26.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}