RUSTSEC-2026-0119: CPU exhaustion during message encoding due to O(n²) name compression
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 5.6k
- Forks
- 1.3k
- Avg merge
- 8h 47m
- Merged PRs (30d)
- 19
Description
CPU exhaustion during message encoding due to O(n²) name compression
| Details | |
|---|---|
| Package | hickory-proto |
| Version | 0.25.2 |
| URL | https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp |
| Date | 2026-05-01 |
| Patched versions | >=0.26.1 |
| Unaffected versions | <0.3.1 |
During message encoding, hickory-proto's BinEncoder stores pointers to
labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>.
The name compression logic then searches for matches with a linear scan.
A malicious message with many records can both introduce many candidate labels,
and invoke this linear scan many times. This can amplify CPU exhaustion in DoS
attacks.
This is similar to
CVE-2024-8508.
We recommend all affected users update to hickory-proto 0.26.1 for the fix.
See advisory page for additional details.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the RUSTSEC-2026-0119 advisory and inspect the repository's dependency declarations for hickory-proto 0.25.2. Update the affected dependency to version 0.26.1 or later, then verify that the project resolves the patched version and its existing checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100