RUSTSEC-2026-0119: hickory-proto: CPU exhaustion during message encoding due to O(n²) name compression
Open
- Dominant language
- Rust
- Stars
- 56.8k
- Forks
- 2.9k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 5
Description
This is currently ignored as it requires libp2p bump to fix. See https://github.com/FuelLabs/fuel-core/pull/3292
https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp
Contributor guide
Research direction
Start by reviewing the dependency context in this issue and FuelLabs/fuel-core pull request 3292, then inspect how the libp2p dependency is managed. Done means the required libp2p bump addresses the hickory-proto advisory and this issue is no longer ignored.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100