Deps.rs

hickory-resolver 0.24.1

[![dependency status](https://deps.rs/crate/hickory-resolver/0.24.1/status.svg)](https://deps.rs/crate/hickory-resolver/0.24.1)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate hickory-resolver

Dependencies

(20 total, 7 outdated, 1 insecure)

CrateRequiredLatestStatus
 cfg-if^11.0.5up to date
 futures-util^0.3.50.3.34up to date
 hickory-proto ⚠️^0.24.00.26.3insecure
 ipconfig^0.3.00.3.4up to date
 lru-cache^0.1.20.1.2up to date
 once_cell^1.18.01.21.4up to date
 parking_lot^0.120.12.5up to date
 rand^0.80.10.2out of date
 resolv-conf^0.7.00.7.6up to date
 rustls^0.21.60.23.45out of date
 rustls-native-certs^0.6.30.8.4out of date
 serde^1.01.0.229up to date
 smallvec^1.61.16.1up to date
 thiserror^1.0.202.0.20out of date
 tokio^1.211.53.1up to date
 tokio-native-tls^0.3.00.3.1up to date
 tokio-openssl^0.6.00.6.5up to date
 tokio-rustls^0.24.00.26.5out of date
 tracing^0.1.300.1.44up to date
 webpki-roots^0.25.01.0.9out of date

Dev dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 futures-executor^0.3.50.3.34up to date
 tokio^1.211.53.1up to date
 tracing-subscriber^0.30.3.23up to date

Security Vulnerabilities

hickory-proto: CPU exhaustion during message encoding due to O(n²) name compression

RUSTSEC-2026-0119

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.