CVE-2026-114605 Details
Description
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.
A denial-of-service vulnerability has been identified in dnspython, a DNS toolkit for Python, prior to version 2.9.0. The issue arises in the 'dns.name.from_wire_parser' function, which processes DNS wire-format messages. The parser follows DNS compression pointer chains without a hop limit, allowing a maliciously crafted DNS message to cause excessive CPU usage during name decompression. This unrestrained pointer traversal can lead to application degradation or a denial-of-service condition in applications that handle untrusted DNS messages.
Users can upgrade to dnspython version 2.9.0 or later, where this vulnerability has been fixed. The updated version is available on the Python Package Index (PyPI).
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023 | [email protected] | Source CodeVendor |
| https://github.com/rthalley/dnspython/releases/tag/v2.9.0 | [email protected] | Release NotesVendor |
| https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dnspython | < 2.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |