Deps.rs

mongodb 3.1.1

[![dependency status](https://deps.rs/crate/mongodb/3.1.1/status.svg)](https://deps.rs/crate/mongodb/3.1.1)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate mongodb

Dependencies

(52 total, 22 outdated, 1 insecure)

CrateRequiredLatestStatus
 async-trait^0.1.420.1.92up to date
 base64^0.13.00.23.1out of date
 bitflags^1.1.02.13.2out of date
 bson^2.13.03.1.0out of date
 chrono^0.4.70.4.45up to date
 derive-where^1.2.71.7.0up to date
 derive_more^0.99.172.1.1out of date
 flate2^1.01.1.10up to date
 futures-core^0.3.140.3.34up to date
 futures-executor^0.3.140.3.34up to date
 futures-io^0.3.210.3.34up to date
 futures-util^0.3.140.3.34up to date
 hex^0.4.00.4.3up to date
 hickory-proto ⚠️^0.24.20.26.3insecure
 hickory-resolver^0.24.20.26.3out of date
 hmac^0.12.10.13.0out of date
 log^0.4.170.4.34up to date
 md-5^0.10.10.11.0out of date
 mongocrypt^0.2.00.4.0out of date
 mongodb-internal-macros^3.1.13.9.1up to date
 num_cpus^1.13.11.17.0up to date
 once_cell^1.19.01.21.4up to date
 openssl^0.10.380.10.81up to date
 openssl-probe^0.1.50.2.1out of date
 pbkdf2^0.11.00.13.0out of date
 percent-encoding^2.0.02.3.2up to date
 rand^0.8.30.10.2out of date
 rayon^1.5.31.12.0up to date
 reqwest^0.11.20.13.5out of date
 rustc_version_runtime^0.3.00.3.0up to date
 rustls^0.21.60.23.45out of date
 rustls-pemfile^1.0.12.2.0out of date
 serde^1.0.1251.0.229up to date
 serde_bytes^0.11.50.11.19up to date
 serde_with^3.8.13.23.0up to date
 sha-1^0.10.00.10.1up to date
 sha2^0.10.20.11.0out of date
 snap^1.0.51.1.2up to date
 socket2^0.5.50.6.5out of date
 stringprep^0.1.20.1.5up to date
 strsim^0.11.10.11.1up to date
 take_mut^0.2.20.2.2up to date
 thiserror^1.0.242.0.20out of date
 tokio^1.17.01.53.1up to date
 tokio-openssl^0.6.30.6.5up to date
 tokio-rustls^0.24.10.26.5out of date
 tokio-util^0.7.00.7.19up to date
 tracing^0.1.360.1.44up to date
 typed-builder^0.10.00.23.2out of date
 uuid^1.1.21.26.1up to date
 webpki-roots^0.25.21.0.9out of date
 zstd^0.11.20.14.0out of date

Dev dependencies

(19 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.01.0.104up to date
 approx^0.5.10.5.1up to date
 backtrace^0.3.680.3.76up to date
 ctrlc^3.2.23.5.2up to date
 function_name^0.2.10.3.0out of date
 futures^0.30.3.34up to date
 hex^0.40.4.3up to date
 home^0.50.5.12up to date
 lambda_runtime^0.6.01.4.0out of date
 pretty_assertions^1.3.01.4.1up to date
 regex^1.6.01.13.1up to date
 semver^1.0.01.0.28up to date
 serde>=0.0.01.0.229up to date
 serde-hex^0.1.00.1.0up to date
 serde_json^1.0.641.0.151up to date
 serde_path_to_error^0.10.1.20up to date
 time^0.3.90.3.55up to date
 tokio>=0.0.01.53.1up to date
 tracing-subscriber^0.3.160.3.23up to date

Security Vulnerabilities

hickory-proto: CPU exhaustion during message encoding due to O(n²) name compression

RUSTSEC-2026-0119

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.