Deps.rs

libp2p-mdns 0.46.0

[![dependency status](https://deps.rs/crate/libp2p-mdns/0.46.0/status.svg)](https://deps.rs/crate/libp2p-mdns/0.46.0)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate libp2p-mdns

Dependencies

(15 total, 6 outdated, 1 insecure)

CrateRequiredLatestStatus
 async-io^2.3.32.6.0up to date
 async-std^1.12.01.13.2up to date
 data-encoding^2.6.02.11.1up to date
 futures^0.3.300.3.34up to date
 hickory-proto ⚠️^0.24.10.26.3insecure
 if-watch^3.2.03.2.2up to date
 libp2p-core^0.42.00.44.0out of date
 libp2p-identity^0.2.90.3.0out of date
 libp2p-swarm^0.45.00.48.0out of date
 rand^0.8.30.10.3out of date
 smallvec^1.13.21.16.2up to date
 socket2^0.5.70.6.5out of date
 tokio^1.381.53.1up to date
 tracing^0.1.370.1.44up to date
 void^1.0.21.0.2up to date

Dev dependencies

(7 total, 4 outdated)

CrateRequiredLatestStatus
 async-std^1.9.01.13.2up to date
 libp2p-noise^0.44.00.47.0out of date
 libp2p-swarm^0.45.00.48.0out of date
 libp2p-tcp^0.42.00.45.0out of date
 libp2p-yamux^0.45.20.48.0out of date
 tokio^1.381.53.1up to date
 tracing-subscriber^0.30.3.23up to date

Security Vulnerabilities

hickory-proto: CPU exhaustion during message encoding due to O(n²) name compression

RUSTSEC-2026-0119

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.