---
id: RUSTSEC-2026-0119
aliases:
  - GHSA-q2qq-hmj6-3wpp
title: CPU exhaustion during message encoding due to O(n²) name compression
summary: CPU exhaustion during message encoding due to O(n²) name compression
severity: none
vendor: hickory-proto
product: hickory-proto
ecosystem: rust
affected:
  - 'hickory-proto >= 0.3.1, < 0.26.1'
patched:
  - hickory-proto 0.26.1
published: '2026-05-01'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:13.569223841Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0119'
references:
  - url: 'https://crates.io/crates/hickory-proto'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0119.html'
  - url: 'https://github.com/hickory-dns/hickory-dns/pull/3613'
tags:
  - osv
  - rust
ingestedAt: '2026-10-13T11:45:30.191Z'
---

## Overview

During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to
labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`.
The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels,
and invoke this linear scan many times. This can amplify CPU exhaustion in DoS
attacks.

This is similar to
[CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).

We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.

## Affected packages

- `hickory-proto >= 0.3.1, < 0.26.1`

## Remediation

Upgrade to a patched release:

- `hickory-proto 0.26.1`