Rust advisories / hickory-proto
Vulnerability MediumRUSTSEC-2026-0119 · hickory-proto
RUSTSEC-2026-0119: CPU exhaustion during message encoding due to O(n²) name compression
Short answerA security vulnerability in the hickory-proto crate: CPU exhaustion during message encoding due to O(n²) name compression. GitHub rates it Medium. Fixed in 0.26.1: update to a fixed version.
| Crate | hickory-proto |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | From 0.3.1 before 0.26.1. |
| Fixed in | 0.26.1 |
| Severity | Medium (GitHub rating) |
| Published | 2026-05-01 |
| Last changed | 2026-10-12 |
| Also known as | GHSA-q2qq-hmj6-3wpp |
What to do
- See which version you have:
cargo tree -i hickory-proto(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p hickory-proto. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplehickory-proto = "0.26.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.
A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.
This is similar to CVE-2024-8508.
We recommend all affected users update to hickory-proto 0.26.1 for the fix.
References
- Package: crates.io/crates/hickory-proto
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0119.html
- Web: github.com/hickory-dns/hickory-dns/pull/3613
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for hickory-proto
- VulnerabilityRUSTSEC-2025-0006 · 2025-02-07Hickory DNS failure to verify self-signed RRSIG for DNSKEYs
- VulnerabilityRUSTSEC-2026-0118 · 2026-05-01NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
- VulnerabilityGHSA-37wc-h8xc-5hc4 · 2025-02-10Hickory DNS's DNSSEC validation may accept broken authentication chains
Up next
Same cratehickory-proto: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?