During message encoding, hickory-proto's BinEncoder stores pointers to
labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>.
The name compression logic then searches for matches with a linear scan.
A malicious message with many records can both introduce many candidate labels,
and invoke this linear scan many times. This can amplify CPU exhaustion in DoS
attacks.
This is similar to
CVE-2024-8508.
We recommend all affected users update to hickory-proto 0.26.1 for the fix.
hickory-proto0.25.2During message encoding,
hickory-proto'sBinEncoderstores pointers tolabels that are candidates for name compression in a
Vec<(usize, Vec<u8>)>.The name compression logic then searches for matches with a linear scan.
A malicious message with many records can both introduce many candidate labels,
and invoke this linear scan many times. This can amplify CPU exhaustion in DoS
attacks.
This is similar to
CVE-2024-8508.
We recommend all affected users update to
hickory-proto0.26.1 for the fix.