Deps.rs

hickory-recursor 0.24.2

[![dependency status](https://deps.rs/crate/hickory-recursor/0.24.2/status.svg)](https://deps.rs/crate/hickory-recursor/0.24.2)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate hickory-recursor

Dependencies

(15 total, 4 outdated, 1 insecure)

CrateRequiredLatestStatus
 async-recursion^1.0.01.1.1up to date
 async-trait^0.1.430.1.92up to date
 backtrace^0.3.500.3.76up to date
 bytes^11.12.1up to date
 cfg-if^11.0.5up to date
 enum-as-inner^0.60.7.0out of date
 futures-util^0.3.50.3.34up to date
 hickory-proto ⚠️^0.24.00.26.3insecure
 hickory-resolver^0.24.00.26.3out of date
 lru-cache^0.1.20.1.2up to date
 parking_lot^0.120.12.5up to date
 serde^1.01.0.229up to date
 thiserror^1.0.202.0.20out of date
 tokio^1.211.53.1up to date
 tracing^0.1.300.1.44up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 tokio^1.211.53.1up to date
 tracing-subscriber^0.30.3.23up to date

Security Vulnerabilities

hickory-proto: CPU exhaustion during message encoding due to O(n²) name compression

RUSTSEC-2026-0119

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.