Threats tagged 'ghsa-6rvc-hrvg-mqf2'

A vulnerability in the DNS wire-format message parser of hickory-proto (Hickory DNS) versions 0.18 up to but not including 0.26.2 allows remote attackers to cause excessive memory allocation. The parser preallocates record vectors based on untrusted header fields (ANCOUNT, NSCOUNT, ARCOUNT), which can be set to 65535 by an attacker, leading to about 18MB of memory allocation per message. This can result in a denial of service due to resource exhaustion.