6.9

GHSA-Q2QQ-HMJ6-3WPP: hickory-proto Crates.Io

CVSS: 6.9v4.0MediumPublished
AliasesRUSTSEC-2026-0119
Published 01-05-2026Last modified 12-10-2026
Open JSON

Vulnerability summary

GHSA-Q2QQ-HMJ6-3WPP is a medium (CVSS 6.9) vulnerability in hickory-proto Crates.Io.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.9/10
010
Medium · v4.0 (OSV · Crates.io), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 50 · Related 2
CGA-22GW-85MQ-XJPWCGA-274R-X4RJ-F6GGCGA-2C4W-MHMH-X5V9CGA-2QJ6-W82F-2P4QCGA-33PH-HJF8-2WRFCGA-3FMF-3JPC-X9CQ

Timeline

  1. 01-05-2026
    PublishedVulnerability first disclosed.
  2. 12-10-2026
    Last modifiedVulnerability information updated.

Description

CPU exhaustion during message encoding due to O(n²) name compression During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`. The name compression logic then searches for matches with a linear scan. A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks. This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt). We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Crates.Io1 product
  • hickory-proto≥ 0.3.1, < 0.26.1

1 vendor · 1 product

References

5 links