Rust advisories / trust-dns-server
Vulnerability MediumRUSTSEC-2023-0041 · trust-dns-server
RUSTSEC-2023-0041: Remote Attackers can cause Denial-of-Service (packet loops) with crafted DNS packets
Short answerA security vulnerability in the trust-dns-server crate: Remote Attackers can cause Denial-of-Service (packet loops) with crafted DNS packets. GitHub rates it Medium. Fixed in 0.22.1, 0.23.0-alpha.3: update to a fixed version.
| Crate | trust-dns-server |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 0.22.1; from 0.23.0 before 0.23.0-alpha.3. |
| Fixed in | 0.22.1, 0.23.0-alpha.3 |
| Severity | Medium (GitHub rating) |
| Published | 2023-06-01 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-5fm9-h728-fwpj |
What to do
- See which version you have:
cargo tree -i trust-dns-server(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p trust-dns-server. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampletrust-dns-server = "0.23.0-alpha.3") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
trust-dns and trust-dns-server are vulnerable to remotely triggered denial-of-service attacks, consuming both network and CPU resources. DNS messages with the QR=1 bit set are responded to with a FormErr response. This allows creating a traffic loop, in which these FormErr responses are sent nonstop between vulnerable servers.
There are two scenarios how this can be exploited: 1) Create a loop between two instances of trust-dns, consuming network resources, or 2) consuming the CPU of a single instance.
With two instances *A* and *B* an attacker sends a DNS query with a spoofed source IP address to *A*. *A* replies with a FormErr to *B*. Now both servers with ping-pong the message back and forth until by chance the packet is dropped in the network. Multiple spoofed packets can be sent by the attacker, increasing resource consumption.
A single server can get locked up replying to itself. Same setup as above, but now *A* sends the reply to itself. The packet is sent out as fast as the CPU and network stack manage. This locks up a CPU core. Multiple packets from the attacker consume multiple CPU cores.
References
- Package: crates.io/crates/trust-dns-server
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0041.html
- Web: github.com/bluejekyll/trust-dns/pull/1952
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for trust-dns-server
Up next
Same cratetrust-dns-server: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?