mediumVulnerability
GHSA-q2qq-hmj6-3wpp
During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`. The name compression logic then searches for matches with a linear scan. A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks. This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt). ### Reporter Qifan Zhang, Palo Alto Networks
Properties
- ghsa_id
- GHSA-q2qq-hmj6-3wpp
- severity
- medium
- summary
- hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression
- cve_id
- GHSA-q2qq-hmj6-3wpp
- is_ghsa_only
- true
- ghsa_published
- 2026-05-07T02:59:48Z
- source_url
- https://github.com/advisories/GHSA-q2qq-hmj6-3wpp
- ghsa_updated
- 2026-05-07T02:59:50Z
Related Entities (5)
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (1)
←[Software]rust/hickory-proto
AFFECTS (1)
→[Software]rust/hickory-proto
HAS_WEAKNESS (2)
→[Weakness]Allocation of Resources Without Limits or Throttling
→[Weakness]Inefficient Algorithmic Complexity
Explore deeper with Ninja Signal's threat intelligence graph