dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.
Metrics
Affected Vendors & Products
References
History
Thu, 29 Oct 2026 03:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 23 Oct 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Rthalley
Rthalley dnspython |
|
| Weaknesses | CWE-606 | |
| Vendors & Products |
Rthalley
Rthalley dnspython |
|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Thu, 22 Oct 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0. | |
| Title | dnspython dns.name.from_wire_parser() excessive CPU use | |
| Weaknesses | CWE-674 | |
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-10-22T16:25:32.509Z
Updated: 2026-10-29T02:19:02.339Z
Reserved: 2026-10-21T20:34:25.599Z
Link: CVE-2026-114605
Updated: 2026-10-29T02:18:57.478Z
Status : Deferred
Published: 2026-10-22T17:16:58.237
Modified: 2026-10-29T04:18:24.280
Link: CVE-2026-114605