Read the docs
TI-2026-86750 Aliases CVE-2026-123608GHSA-jcq8-9rwq-2c6j

CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression

Priority MEDIUM 53CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-407.

Summary

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service flaw in BinEncoder. The name compression step takes quadratic time (CWE-407), so remote attackers can exhaust CPU by sending DNS messages with many records that add many candidate labels. Each candidate label triggers a repeated linear scan during encoding, which amplifies the CPU load.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.

Why it matters now

Fix Fixed hickory-dns (hickory-dns): 0.26.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hickory-dnshickory-dns0.3.1 to before 0.26.10.26.1Patch availableCNA
  • hickory-dns Vendorhickory-dns Affected 0.3.1 to before 0.26.1 Fixed in 0.26.1 Patch available CNA

Remediation

Upgrade hickory-proto to version 0.26.1, which fixes the flaw in the affected range from 0.3.1 before 0.26.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hickory-dns 0.26.1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of servicePriority MEDIUM 53
    Show all 2 records →

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123608
  2. 2026-11-08 Alias added: GHSA-jcq8-9rwq-2c6j

References

Advisory 1

  • TI-2025-18857 DNSSEC validation may accept broken authentication chains CVSS 4.0MEDIUM 5.7
  • TI-2026-86729 DNSSEC nonexistence forgery in Hickory DNS via wraparound NSEC CVSS 4.0HIGH 8.9
  • TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
  • TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer name CVSS 4.0HIGH 8.7
  • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustion CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences