DEBIAN-CVE-2026-123608: Debian/rust-hickory-proto vulnerability

Q: Who is exposed to this denial-of-service issue?

Systems using the Debian rust-hickory-proto package with an affected Hickory DNS hickory-proto version are exposed when they process attacker-controlled DNS messages that reach the vulnerable encoding path.

Q: What does an attacker need to do to trigger the issue?

An attacker needs to send malicious DNS messages containing many records that add many candidate labels. These messages cause repeated linear scans during name compression, resulting in quadratic CPU consumption.

Q: How can I determine whether my system is affected?

Check the version of Hickory DNS hickory-proto provided by Debian's rust-hickory-proto package. Versions from 0.3.1 before 0.26.1 are affected; version 0.26.1 is outside the affected range.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-proto*

debian/rust-hickory-proto<0.26.1-1

0.26.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-proto to a version that resolves this vulnerability.
Fixed in 0.26.1-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Systems using the Debian rust-hickory-proto package with an affected Hickory DNS hickory-proto version are exposed when they process attacker-controlled DNS messages that reach the vulnerable encoding path.

What does an attacker need to do to trigger the issue?

An attacker needs to send malicious DNS messages containing many records that add many candidate labels. These messages cause repeated linear scans during name compression, resulting in quadratic CPU consumption.

How can I determine whether my system is affected?

Check the version of Hickory DNS hickory-proto provided by Debian's rust-hickory-proto package. Versions from 0.3.1 before 0.26.1 are affected; version 0.26.1 is outside the affected range.

DEBIAN-CVE-2026-123608: Debian/rust-hickory-proto vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

How can I determine whether my system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

How can I determine whether my system is affected?