{"id":"GHSA-q2qq-hmj6-3wpp","summary":"hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression","details":"During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec\u003c(usize, Vec\u003cu8\u003e)\u003e`. The name compression logic then searches for matches with a linear scan.\n\nA malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.\n\nThis is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).\n\n### Reporter\n\nQifan Zhang, Palo Alto Networks","aliases":["RUSTSEC-2026-0119"],"modified":"2026-05-08T07:14:21.676604269Z","published":"2026-05-07T02:59:48Z","related":["CGA-g2xw-v9pc-qphv"],"database_specific":{"github_reviewed":true,"severity":"MODERATE","cwe_ids":["CWE-407","CWE-770"],"nvd_published_at":null,"github_reviewed_at":"2026-05-07T02:59:48Z"},"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0119.html"}],"affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.1"},{"fixed":"0.26.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 0.26.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q2qq-hmj6-3wpp/GHSA-q2qq-hmj6-3wpp.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}