https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T05:05:35.320405+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/ghsa-q2qq-hmj6-3wpp GHSA-q2qq-hmj6-3wpp — hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression 2026-10-06T05:05:36.067772+00:00

Affected: crates.io: hickory-proto

During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).

### Reporter

Qifan Zhang, Palo Alto Networks