security: hickory-proto in iroh-sidecar — gated on iroh upstream (Dependabot #38, #39)

[danmestas]

Why

Two open Dependabot security alerts on hickory-proto in iroh-sidecar/Cargo.lock. Neither can be resolved by a clean cargo update today — the fix is gated on iroh upstream.

#	Severity	CVE summary	Vulnerable range	Patched
#38	High	NSEC3 closest-encloser proof validation — unbounded loop on cross-zone responses (DoS)	>= 0.25.0-alpha.3, <= 0.25.2	no upstream patch yet
#39	Medium	CPU exhaustion during message encoding — O(n²) name compression (DoS)	>= 0.3.1, <= 0.26.0	0.26.1

Current resolution path

iroh = "0.97"          (iroh-sidecar/Cargo.toml)
  → iroh 0.97.0
    → hickory-resolver 0.25.2
      → hickory-proto 0.25.2     ← vulnerable to BOTH alerts

What's gating the fix

Upstream iroh pins hickory-resolver with an exact = requirement, which prevents Cargo from picking up the patched range:

iroh version	hickory-resolver requirement	Resolves to hickory-proto
0.97.0 (current)	=0.25.2	0.25.2 — vulnerable
0.98.0 – 0.98.2	=0.26.0-beta.4	0.26.0-beta.4 — vulnerable (still in <= 0.26.0 range for #39; semver 0.26.0-beta.4 < 0.26.0)
1.0.0-rc.0	^0.26.0	0.26.1 — fixes #39; #38 has no patch

So even iroh's latest stable (0.98.2) doesn't get us past #39. Only iroh 1.0.0-rc.0's caret req lets cargo pick the patched hickory-proto 0.26.1.

Dependabot security updates are enabled on the repo — the absence of an auto-PR confirms there's no clean version-bump path within the existing iroh major.

Options

1. Hold and monitor. Wait for iroh 1.0.0 stable. iroh-sidecar is internal infrastructure; the vulnerable code path is DNS resolution against attacker-controlled responses. Real risk is gated on whether iroh-sidecar queries hostile DNS sources.

2. Bump to iroh = "1.0.0-rc.0". Resolves chore: trim GitNexus CLAUDE.md, consolidate docs, add hook #39. Tradeoff: takes a release-candidate dependency, may require API-surface adjustments in iroh-sidecar/src/main.rs. Doesn't help feat(sync): handle private branch cards (CDG-117) #38 (no upstream patch exists).

3. [patch.crates-io] override to force hickory-proto >= 0.26.1. Unlikely to work cleanly — iroh 0.97/0.98 pin hickory-resolver to an = version whose own deps reference =-pinned hickory-proto. The override would conflict at the resolver, and bypassing it via a hickory-resolver patch too risks ABI mismatches with iroh's expectations.

Recommended

Option 1 unless iroh-sidecar is reachable from untrusted DNS. Reassess when iroh ships 1.0.0 stable — Dependabot should auto-PR the bump at that point.

References

• hickory-proto 0.26.1 release notes (fix for chore: trim GitNexus CLAUDE.md, consolidate docs, add hook #39): https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.1
• iroh upcoming 1.0: https://github.com/n0-computer/iroh/releases
• Filed by operator triage 2026-05-16 — no immediate action expected.

[danmestas]

Revalidated 2026-07-22

The two runtime hickory-proto Dependabot alerts remain open in iroh-sidecar/Cargo.lock:

• feat(sync): handle private branch cards (CDG-117) #38 — High: GHSA-3v94-mw7p-v465, unbounded loop during NSEC3 closest-encloser proof validation.
• chore: trim GitNexus CLAUDE.md, consolidate docs, add hook #39 — Medium: GHSA-q2qq-hmj6-3wpp, O(n²) name-compression CPU exhaustion.

GitHub currently reports no clean patched version for either alert in the locked dependency path. The mitigation remains to keep iroh-sidecar off untrusted DNS-resolution paths, monitor iroh upstream for a stable release that permits the patched hickory line, and reassess the release-candidate upgrade separately. No dependency override was applied.