RUSTSEC-2026-0119
NoneCVSS
—
EPSS
—
Published
May 1, 2026
CISA due date
—
The record
CPU exhaustion during message encoding due to O(n²) name compression
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | hickory-proto | 0.3.1 | 0.26.1 |
| Alpine:v3.17 | unbound | 0 | 1.20.0-r1 |
| Alpine:v3.18 | unbound | 0 | 1.20.0-r1 |
| Alpine:v3.19 | unbound | 0 | 1.20.0-r1 |
| Alpine:v3.20 | unbound | 0 | 1.20.0-r1 |
| Alpine:v3.21 | unbound | 0 | 1.21.1-r0 |
| Alpine:v3.22 | unbound | 0 | 1.21.1-r0 |
| Debian:11 | unbound | 0 | No fix |
| Debian:12 | unbound | 0 | No fix |
| Debian:13 | unbound | 0 | No fix |
| Debian:14 | unbound | 0 | 1.21.1-1 |
Related vulnerabilities
- CVE-2024-8508 NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when… Same vulnerability
- RUSTSEC-2026-0120 NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses Also affects hickory-proto
- CVE-2024-33655 The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of… Also affects unbound
- CVE-2023-50868 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… Also affects unbound
- CVE-2024-43168 DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by… Also affects unbound
- CVE-2024-43167 DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by… Also affects unbound
- CVE-2019-25031 Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon… Also affects unbound
- CVE-2014-8602 iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which… Also affects unbound