hickory-proto CVE-2026-123608

No special configuration is required: any deployment that uses hickory-proto (versions >= 0.3.1 and <= 0.26.0) to encode DNS messages whose contents an attacker can influence is exposed, since the quadratic cost occurs in the default BinEncoder name-compression path. The concrete trigger is a DNS message carrying many records that introduce many candidate labels, forcing repeated linear scans during encoding. The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction. The main limiting factor is reachability: the attacker must be able to cause the application to encode an attacker-controlled, record-heavy message (e.g., a server/resolver building or forwarding responses), and the deployment must run a vulnerable version (fixed in 0.26.1).

This is a genuine, well-corroborated denial-of-service issue but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated condition whose entire impact is availability (VA:H; confidentiality and integrity are N), which is consistent with CWE-407 (algorithmic complexity) and the advisory's CWE-770 (resource exhaustion). The 8.7 score is driven almost entirely by the availability impact plus the clean remote/unauth vector, not by any code-execution or data-exposure risk. No EPSS probability is provided in the input, no CISA KEV listing is present, and no public exploit or PoC reference is supplied - only vendor/advisory references (GHSA and VulnCheck) - so there is no evidence of active exploitation. The vuln.today decision label is 'this_week', which aligns with a real but non-critical priority: a prioritize-and-patch item rather than act_now/emergency. Net: treat as a credible availability risk for exposed hickory-proto deployments, but the absence of KEV/EPSS/PoC signals means there is no indication of widespread or imminent exploitation at time of analysis.

A remote, unauthenticated attacker sends crafted DNS messages containing many records that introduce a large number of name-compression candidate labels, so that when hickory-proto's BinEncoder serializes the message it performs repeated linear scans over the candidate list, producing O(n²) work. The resulting CPU exhaustion degrades or denies service for the affected DNS component. No public exploit code is identified in the provided sources, though the advisory notes the pattern is analogous to CVE-2024-8508 in Unbound.