CVE-2026-123608 · Package
NO FIX YET · SEE WHAT TO DO
hickory-proto, the DNS protocol library in the Hickory DNS project, takes quadratic time when encoding messages that carry many records with many candidate labels. A remote attacker can send such DNS messages to exhaust a server's CPU and cause denial of service.
first public May 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications written in Rust that use hickory-proto from 0.3.1 before 0.26.1 to encode DNS messages, including DNS servers built on Hickory DNS, are exposed to remote CPU exhaustion. Services that only use DNS as a client or do not expose a DNS encoder to untrusted traffic can skip it.
Not affected if client-only-use, version-0.26.1-or-later
Who cares dns-server, hickory-dns, rust
hickory-proto in your Cargo.lock (cargo tree -i hickory-proto)hickory-proto 0.26.1 (fixed in releases from 0.3.1 up to, but not including, 0.26.1 are affected)Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.