RUSTSEC-2026-0491

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0491

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0491.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0491

Aliases

CVE-2026-123570
GHSA-67wc-6jq8-ghrc

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T09:45:02Z

Summary

Memory amplification from record counts in the DNS message header

Details

When a DNS message is decoded, the vectors for the question, answer, authority and additional sections were created with Vec::with_capacity set to the counts in the message header. Those counts come from the sender and are not checked against the size of the message, so a single small packet that claims 65,535 records makes the decoder reserve memory for that many records (about 18 MB, according to the upstream advisory) before it reads any record and fails.

Any code that decodes untrusted DNS messages is exposed. That includes servers, and clients and resolvers that receive spoofed responses. Repeated packets can drive memory use up and cause a denial of service.

The fix caps the initial capacity at 8 entries and lets the vectors grow as records are actually decoded. It is in 0.26.2.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-proto

Package

Name: hickory-proto; View open source insights on deps.dev
Purl: pkg:cargo/hickory-proto

Affected ranges

Type: SEMVER
Events: Introduced

0.18.0

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}