https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:05:33 +0000 https://vulnerability.circl.lu/vuln/ghsa-q2qq-hmj6-3wpp <p><strong>Affected:</strong> crates.io: hickory-proto</p> <p>During message encoding, `hickory-proto`&#39;s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec&lt;(usize, Vec&lt;u8&gt;)&gt;`. The name compression logic then searches for matches with a linear scan.</p> <p>A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.</p> <p>This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).</p> <p>### Reporter</p> <p>Qifan Zhang, Palo Alto Networks</p> <p><strong>Affected:</strong> crates.io: hickory-proto</p> <p>During message encoding, `hickory-proto`&#39;s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec&lt;(usize, Vec&lt;u8&gt;)&gt;`. The name compression logic then searches for matches with a linear scan.</p> <p>A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.</p> <p>This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).</p> <p>### Reporter</p> <p>Qifan Zhang, Palo Alto Networks</p> https://vulnerability.circl.lu/vuln/ghsa-q2qq-hmj6-3wpp