During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.

When an SVCB or HTTPS record is parsed from its text (zone file) form, the alpn service parameter value is split into a list of protocol names. That step called expect on the result, on the assumption that it could not fail. A malformed value, such as one with an unbalanced quote (alpn="h), two commas in a row or an invalid escape, makes it fail, so the parser panicked instead of returning an error.

Code that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.

The fix returns a parse error instead. It is in 0.26.2.

When an SVCB or HTTPS record is parsed from its text (zone file) form, surrounding double quotes are removed from each service parameter value by checking that the value starts and ends with " and slicing off the first and last character. A value that is a single " (for example alpn=") passes that check, and the slice [1..0] panics.

Code that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.

The fix rejects a lone quote character with a parse error before the slice. It is in 0.26.2.

The zone file lexer read each token in a loop capped at 4,096 iterations, with an assert! on the loop counter as a safety bound. A single token long enough to reach that bound, for example a very long name or character string in a zone file, triggered the assertion and the parser panicked instead of returning the token or an error.

Code that parses zone files from an untrusted source can be made to panic, which is a denial of service.

The fix removes the iteration bound, so the lexer ends only when it reaches the end of a token or an error. It is in 0.26.2.

When a DNS message is decoded, the vectors for the question, answer, authority and additional sections were created with Vec::with_capacity set to the counts in the message header. Those counts come from the sender and are not checked against the size of the message, so a single small packet that claims 65,535 records makes the decoder reserve memory for that many records (about 18 MB, according to the upstream advisory) before it reads any record and fails.

Any code that decodes untrusted DNS messages is exposed. That includes servers, and clients and resolvers that receive spoofed responses. Repeated packets can drive memory use up and cause a denial of service.

The fix caps the initial capacity at 8 entries and lets the vectors grow as records are actually decoded. It is in 0.26.2.