CVE-2026-123608— Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression
Quick assessment
Affected
hickory-dns hickory-dns
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hickory DNS 项目中的 组件（版本 0.3.1 至 0.26.1 之前）存在一个拒绝服务（DoS）漏洞。该漏洞位于 模块中，允许远程攻击者利用二次时间复杂度的域名压缩机制耗尽 CPU 资源。攻击者可以发送包含大量记录、引入众多候选标签的恶意 DNS 消息，从而在编码过程中触发重复的线性扫描，加剧 CPU 耗尽效应。
Possible ATT&CK Techniques 1 AI
T1499.002 · Service Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-123608
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression
Source: CVE Program / CVE List V5
Vulnerability Description
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| hickory-dns | hickory-dns | 0.3.1 ~ 0.26.1 | - |
|
II. Public POCs for CVE-2026-123608
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-123608
请登录查看更多情报信息。
Other References for CVE-2026-123608 (2)
Same Patch Batch · hickory-dns · 2026-11-08 · 39 CVEs total
| CVE-2026-123595 | 8.8 HIGH | Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3 |
| CVE-2026-123596 | 8.8 HIGH | Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC |
| CVE-2026-123605 | 8.8 HIGH | Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name |
| CVE-2026-123572 | 7.5 HIGH | Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser |
| CVE-2026-123575 | 7.5 HIGH | Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies |
| CVE-2026-123571 | 7.5 HIGH | Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding |
| CVE-2026-123577 | 7.5 HIGH | Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service |
| CVE-2026-123588 | 7.5 HIGH | Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool |
| CVE-2026-123574 | 7.5 HIGH | Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser |
| CVE-2026-123570 | 7.5 HIGH | Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts |
| CVE-2026-123604 | 7.5 HIGH | Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_se |
| CVE-2026-123576 | 7.5 HIGH | Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests |
| CVE-2026-123573 | 7.5 HIGH | hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser |
| CVE-2026-123606 | 7.5 HIGH | Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification |
| CVE-2026-123607 | 7.5 HIGH | Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service |
| CVE-2026-123580 | 7.5 HIGH | Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3 |
| CVE-2026-123586 | 7.5 HIGH | Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals |
| CVE-2026-123587 | 6.8 MEDIUM | Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC |
| CVE-2026-123603 | 6.5 MEDIUM | Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass |
| CVE-2026-123601 | 6.5 MEDIUM | Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: hickory-dns
-
CVE-2026-123606
Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless- -
CVE-2026-123607
Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Deni -
CVE-2026-123605
Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass -
CVE-2026-123604
Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion -
CVE-2026-123603
Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access
Same vendor: hickory-dns
-
CVE-2026-123607
Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Deni -
CVE-2026-123606
Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless- -
CVE-2026-123605
Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass -
CVE-2026-123604
Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion -
CVE-2026-123603
Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access
Same weakness: CWE-407
-
CVE-2026-123559
Zebra before 7.0.0 Denial of Service via Quadratic Sighash C -
CVE-2026-123554
Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempoo -
CVE-2026-123792
Symfony: Exponential and Quadratic Parse Times in the YAML P -
CVE-2026-122306
Kyverno before 1.19.2 Denial of Service via Exponential-Time -
CVE-2026-106554
jackson-dataformat-cbor: quadratic-time TagList growth on un