{"schemaVersion":3,"id":"GHSA-Q2QQ-HMJ6-3WPP","aliases":["RUSTSEC-2026-0119"],"status":"published","duplicateOf":null,"title":null,"description":"CPU exhaustion during message encoding due to O(n²) name compression\n\nDuring message encoding, `hickory-proto`'s `BinEncoder` stores pointers to\nlabels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`.\nThe name compression logic then searches for matches with a linear scan.\n\nA malicious message with many records can both introduce many candidate labels,\nand invoke this linear scan many times. This can amplify CPU exhaustion in DoS\nattacks.\n\nThis is similar to\n[CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).\n\nWe recommend all affected users update to `hickory-proto` 0.26.1 for the fix.","dates":{"published":"2026-05-01T12:00:00.000Z","modified":"2026-10-12T18:00:13.569Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.9,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"OSV · Crates.io","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","computed":true,"selection":"version-preference"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"OSV · Crates.io","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"Crates.Io","product":"hickory-proto","name":"hickory-proto","label":"hickory-proto","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/hickory-proto","purlType":"cargo","versions":[{"text":"≥ 0.3.1, < 0.26.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.3.1, < 0.26.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp","label":"github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/hickory-dns/hickory-dns","label":"github.com/hickory-dns/hickory-dns","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0119.html","label":"rustsec.org/advisories/RUSTSEC-2026-0119.html","hostname":"rustsec.org","tags":["WEB","Advisory"]},{"url":"https://crates.io/crates/hickory-proto","label":"crates.io/crates/hickory-proto","hostname":"crates.io","tags":["PACKAGE"]},{"url":"https://github.com/hickory-dns/hickory-dns/pull/3613","label":"github.com/hickory-dns/hickory-dns/pull/3613","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["CGA-22GW-85MQ-XJPW","CGA-274R-X4RJ-F6GG","CGA-2C4W-MHMH-X5V9","CGA-2QJ6-W82F-2P4Q","CGA-33PH-HJF8-2WRF","CGA-3FMF-3JPC-X9CQ","CGA-4QJ8-JC5J-MX85","CGA-4XP7-RPHR-CCXH","CGA-572P-RC4G-HV8M","CGA-5MHQ-3C7P-F86J","CGA-62PX-CHH2-R95P","CGA-63JF-HHQJ-XF6Q","CGA-6CXF-6RHP-753R","CGA-6WFV-W3XP-MM4P","CGA-75FQ-P63F-64CP","CGA-7CH2-J7FV-V3X3","CGA-7F2R-7MC4-H4WW","CGA-7MHX-J8M8-3XVP","CGA-7RMQ-32FJ-CG62","CGA-7W33-W2RV-HPHR","CGA-85WC-M3J6-4MVM","CGA-88M9-248V-44QJ","CGA-992P-24R6-V7HM","CGA-CRG9-F99J-H23X","CGA-FM62-2QVQ-9583","CGA-FM9J-8GW2-9W94","CGA-GMQ7-7RCP-G278","CGA-JJ7X-V99G-VRH6","CGA-JJFP-4CG6-WG4X","CGA-JJMC-W4FF-2PGH","CGA-JWHC-C4MW-GMF8","CGA-JWJ2-4VFW-26CV","CGA-M8X5-5QR3-5RRX","CGA-MC4W-M98P-MV63","CGA-P54J-2JV5-HVMP","CGA-P5PP-M95G-QV58","CGA-PG2H-W47P-VCPV","CGA-Q2M6-JM7Q-MWW8","CGA-QM5J-XJGH-GPCJ","CGA-R22G-2JJM-MR9F","CGA-R887-25VC-4GHH","CGA-V9RR-FC6H-MM4H","CGA-VCW7-PH46-842Q","CGA-VG7J-HVGR-3879","CGA-W2R8-53HC-P6F8","CGA-WW4X-84P6-WMJC","CGA-X4FW-4JG3-97V2","CGA-X7R5-6M7M-MQ27","CGA-XC65-C4J2-J4VG","CGA-XGCH-WFG4-WWF6"],"duplicates":[],"related":["CGA-G2XW-V9PC-QPHV","CVE-2024-8508"]},"timeline":[{"kind":"published","date":"2026-05-01T12:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-12T18:00:13.569Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T20:28:11.313Z","stale":false,"partial":false}}