Cloudanix VulnDB

CVE-2026-114605

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Oct 22, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in a popular Python library for handling DNS data lets attackers send specially crafted network messages that can slow down or crash applications relying on that library.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

dns.name.from_wire_parser processes attacker-controlled DNS compression pointer chains without enforcing a hop limit, enabling excessive pointer traversal that consumes high CPU during name decompression of untrusted wire-format messages.

Why it matters to the business

Applications relying on dnspython for DNS message handling can experience sustained high CPU load, degraded performance, or complete denial of service when exposed to malicious DNS traffic, disrupting availability of dependent services.

How an attack unfolds

An attacker crafts a DNS wire-format message containing deeply chained or looping compression pointers and sends it to any application that feeds untrusted DNS responses into dnspython's parser; the library follows the pointers without bound, exhausting CPU resources on the target.

How to fix it

Upgrade dnspython to version 2.9.0 or later; where immediate upgrade is not possible, restrict processing of DNS messages from untrusted sources or implement input validation before parsing.

How to confirm the fix worked

Verify installed dnspython version is at least 2.9.0; test affected code paths with known malicious compression-pointer payloads and confirm CPU usage remains bounded.

Typical attack path

  1. Craft a malicious DNS wire-format message with excessive or cyclic compression pointers
  2. Deliver the message to an application that parses untrusted DNS data using dnspython
  3. Trigger dns.name.from_wire_parser on the crafted payload
  4. Observe sustained high CPU consumption leading to application slowdown or crash

How to detect it

Review application and system logs for sudden spikes in CPU usage correlated with DNS message processing; inspect Python process activity for prolonged execution inside dns.name.from_wire_parser or related name decompression routines.

What your security team should do

  • Upgrade dnspython to 2.9.0 across all environments within the next 7 days given recent publication
  • Inventory Python applications that parse untrusted DNS traffic and prioritize patching those with external exposure
  • Add resource limits or timeouts around DNS parsing functions as a temporary control
  • Monitor CPU utilization on hosts running dnspython-based services for anomalous spikes

The record

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities