fix(deps): Patch a DNS encoding CPU exhaustion advisory in hickory - #187
Conversation
hickory-proto 0.25.2 is affected by GHSA-q2qq-hmj6-3wpp (RUSTSEC-2026-0119): name compression during message encoding does a linear scan per label, so a response with many records can burn CPU. The fix is in hickory-proto 0.26.1. This moves to 0.26.3, the latest patch release, which also carries the security fixes from 0.26.2 and the regression fixes that followed them. hickory-server has to move with hickory-proto. The dns-dev server builds Name and Record values with hickory-proto and hands them to hickory-server, so both crates must use the same hickory-proto version. Bumping hickory-proto alone, as Renovate did in #181, leaves hickory-server 0.25.2 on hickory-proto 0.25.2 and the types no longer match. The lockfile also moves the transitive hickory-resolver and hickory-net, which iroh pulls in, from 0.26.1 to 0.26.3. After this change the workspace has a single hickory-proto version. The code changes in dns_dev.rs follow the 0.26 renames and signature changes: ServerFuture is now Server, the authority module is now zone_handler, InMemoryAuthority is now InMemoryZoneHandler and takes an AxfrPolicy instead of a bool (Deny matches the old false), Record exposes dns_class as a public field instead of a setter, and RequestHandler::handle_request gained a Time type parameter that the shared catalog wrapper passes through. The zone contents and serving behavior are unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mcy6SZHB23ewuDivM6uAUi
ecv
changed the title
|
Second-pass verdicts, both merge. pr-rereviewer: VERDICT merge, confirming all four applied title/body findings fixed and verifying the lockfile disclosure against the diff, since every re-picked version (windows-sys, syn, heck, socket2, windows-link, windows-result) already existed in the base Cargo.lock while enum-as-inner and prefix-trie drop out entirely; it ran with #181 closed and CI green on ubuntu, windows-2022, macos, and bundle. pr-conventions-reviewer: VERDICT merge, with one decision noted rather than a blocking finding: open drafts #176 and #158 touch the same datum-connect block in Cargo.lock and cli/Cargo.toml, so the human decided this PR merges first and the others rebase afterwards. First pass for the record: pr-adversary held on then-pending ubuntu CI, since green, plus a nit on the undisclosed lockfile reshuffle, now disclosed. pr-conventions-reviewer held on #181 still open, since closed, a missing issue link, now present as a Related-to line for the GHSA advisory, extra body sections, since removed, and title nits, since fixed. CI on the head is green: ci (ubuntu-latest), ci (windows-2022), ci (macos-latest), bundle (ubuntu-latest), and license/cla all passed; release and update-homebrew show as skipping, which is expected for this PR type. Auto-merge is enabled with the merge method. The branch ruleset requires one approving review with code owner review and last-push approval, so this waits on a human approval before it can land. |
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
Confirmed: hickory-proto is unified at 0.26.3, above the 0.26.1 patched version for GHSA-q2qq-hmj6-3wpp/RUSTSEC-2026-0119. All hickory-* crates (proto, server, resolver, net) move together to 0.26.3, eliminating the duplicate 0.25.2/0.26.1 proto versions that could have left an unpatched copy in the tree. The dns_dev.rs changes correctly adapt to the 0.26 API (ServerFuture->Server, InMemoryAuthority->InMemoryZoneHandler, direct dns_class field, generic Time param on handle_request), and CI is green on Linux/macOS/Windows.
3 participants
Summary
hickory-proto 0.25.2, the DNS library behind the local dev DNS server, can burn CPU when it encodes a message with many records (GHSA-q2qq-hmj6-3wpp, RUSTSEC-2026-0119).
This moves every hickory crate to 0.26.3, including hickory-server, since the dev DNS server hands hickory-proto records to hickory-server and the build breaks when the two land on different versions.
The lockfile also re-picks among already-present duplicate versions of a few unrelated crates, such as socket2 and syn, because a hickory-proto 0.25 dependency dropped out, and no new or foreign versions enter.
The workspace now builds a single hickory-proto version, including the copy iroh pulls in through its resolver.
Test plan
Supersedes #181
Related to GHSA-q2qq-hmj6-3wpp
🤖 Generated with Claude Code
https://claude.ai/code/session_01Mcy6SZHB23ewuDivM6uAUi