https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T21:55:20.307928+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cleanstart-2026-il48239 Withdrawn: CLEANSTART-2026-IL48239 — Security fixes in ztunnel-fips 1.30.0-r0 2026-10-04T21:55:20.311876+00:00

Withdrawn by the publisher.

Affected: CleanStart: ztunnel-fips

Package ztunnel-fips version 1.30.0-r0 fixes 3 vulnerabilities: ghsa-3v94-mw7p-v465, ghsa-q2qq-hmj6-3wpp, ghsa-cq8v-f236-94qc

 https://vulnerability.circl.lu/vuln/rustsec-2026-0119 RUSTSEC-2026-0119 — CPU exhaustion during message encoding due to O(n²) name compression 2026-10-04T21:55:20.311981+00:00

Affected: crates.io: hickory-proto

During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).

We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.