CVE-2026-123608

EUVD-2026-119367
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.48%
Debian logo
Debian Releases
Debian Product
Codename
rust-hickory-proto
forky
0.26.3-1
fixed
sid
0.26.3-1
fixed
trixie
no-dsa
Common Weakness Enumeration
References
https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp
https://www.vulncheck.com/advisories/hickory-dns-hickory-proto-0.3.1-before-0.26.1-cpu-exhaustion-via-binencoder-name-compression