CVE-2026-123608
Received Received - Intake

Denial of Service in Hickory DNS hickory-proto

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123608
EUVD
EUVD-2026-119367

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hickory_dns hickory_proto From 0.3.1 (inc) to 0.26.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service issue in Hickory DNS's hickory-proto library versions 0.3.1 to 0.26.1. It involves a flaw in the BinEncoder component where malicious DNS messages with many records cause repeated linear scans during encoding, leading to CPU exhaustion through quadratic-time name compression.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual CPU usage spikes during DNS queries. Check for processes using hickory-proto versions between 0.3.1 and 0.26.1. Use system monitoring tools like 'top', 'htop', or 'ps' to observe CPU consumption by DNS-related processes. Inspect network traffic for DNS messages with excessive records or labels.

Impact Analysis

Attackers can exploit this to consume excessive CPU resources on affected systems, potentially causing service slowdowns or crashes. This may disrupt DNS resolution services and degrade network performance for users relying on Hickory DNS.

Mitigation Strategies

Immediately update hickory-proto to version 0.26.1 or later. If using Hickory DNS, ensure the entire stack is updated. Temporarily restrict DNS traffic to trusted sources using firewalls. Monitor CPU usage and DNS query patterns for anomalies. Consider disabling DNS compression if not critical.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...