High severity7.5NVD Advisory· Published Nov 8, 2026

CVE-2026-123608

Description

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Hickory DNS/Hickory DNSllm-fuzzy
Range: <0.26.1

Patches

Vulnerability mechanics

References

github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wppnvd
www.vulncheck.com/advisories/hickory-dns-hickory-proto-0.3.1-before-0.26.1-cpu-exhaustion-via-binencoder-name-compressionnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000