GHSA-jcq8-9rwq-2c6jHighCVSS 7.5
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in...
🔗 CVE IDs covered (1)
📋 Description
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.
🔗 References (4)
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp
- https://nvd.nist.gov/vuln/detail/CVE-2026-123608
- https://www.vulncheck.com/advisories/hickory-dns-hickory-proto-0.3.1-before-0.26.1-cpu-exhaustion-via-binencoder-name-compression
- https://github.com/advisories/GHSA-jcq8-9rwq-2c6j