RUSTSEC-2026-0119: CPU exhaustion during message encoding due to O(n²) name compression

> CPU exhaustion during message encoding due to O(n²) name compression | Details | | | ------------------- | ---------------------------------------------- | | Package | `hickory-proto` | | Version | `0.25.2` | | URL | [https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp) | | Date | 2026-05-01 | | Patched versions | `>=0.26.1` | | Unaffected versions | `<0.3.1` | During message encoding, `hickory-proto`&#39;s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec&lt;(usize, Vec&lt;u8&gt;)&gt;`. The name compression logic then searches for matches with a linear scan. A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks. This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt). We recommend all affected users update to `hickory-proto` 0.26.1 for the fix. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0119.html) for additional details.