Reported

May 1, 2026

Issued

May 1, 2026

Package

hickory-proto (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#dns

References

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp

Related

• CVE-2024-8508

Patched

• >=0.26.1

Unaffected

• <0.3.1

Description

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.

Advisory available under CC-BY-4.0 license. Source: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp