The vulnerability resides in the BinEncoder component of the hickory‑proto library, where name compression operations run in quadratic time relative to the number of candidate labels. Remote attackers can forge DNS messages containing many records that trigger repeated linear scans during encoding, exhausting CPU resources. This leads to a denial of service of the DNS service and potentially other services depending on it, as the process becomes overwhelmed. The weakness is classified as CWE‑407 (Improper Resource Management).

Affected products are hickory-dns from version 0.3.1 through 0.25.x, inclusive, forgoing the 0.26.1 release and later. Any deployment of hickory-proto before 0.26.1 that processes DNS queries from untrusted sources is susceptible.

The CVSS score of 8.7 indicates a high severity. EPSS is not available, but the lack of listing in the CISA KEV catalog implies no known widespread exploitation yet; however, the remote nature of the attack via standard DNS traffic and the easily craftable malicious packets suggest a potentially moderate exploit likelihood for actively scanning adversaries. Immediate patching is recommended to avoid resource exhaustion and service downtime.