UBUNTU-CVE-2026-123608: High severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using hickory-proto versions from 0.3.1 up to, but not including, 0.26.1 are affected. The listed Ubuntu software package is ubuntu/rust-hickory-proto.
Does exploitation require authentication or user interaction?
No. The severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
How can I determine whether I am affected?
Check the hickory-proto version in use by the affected application or package. Versions earlier than 0.26.1 within the stated affected range are vulnerable.
What should be done if the affected version is deployed?
Move to hickory-proto 0.26.1 or later, which is outside the stated affected range. The documented impact is CPU exhaustion resulting in denial of service.