CVE-2026-114605 with a CVSS score of 7.5 is a denial-of-service vulnerability in the dnspython library, specifically in the dns.name.from_wire_parser() function used for DNS name decompression. The flaw is an uncontrolled resource consumption issue triggered by a maliciously crafted DNS message. Applications that process untrusted DNS wire form messages with dnspython can be affected when an attacker supplies a specially constructed DNS name that causes the parser to consume excessive CPU while decompressing the name. The attack vector is network-based, requires low complexity, and does not require authentication, user interaction, or special privileges, meaning a remote attacker can exploit it by sending crafted DNS traffic to a vulnerable service. The primary business impact is availability degradation, because excessive CPU usage can slow or exhaust processing capacity, potentially causing denial of service for DNS-dependent operations. The affected software is dnspython (pip) versions < 2.9.0, which are subject to this excessive CPU behavior. The vulnerability does not imply direct data disclosure or integrity compromise, but it can disrupt services that rely on reliable DNS parsing and can amplify operational risk in environments where untrusted DNS input is processed.
We recommend you to update dnspython to version 2.9.0.[/subscribe_to_unlock_form]
CVE-2026-114605 with a CVSS score of 7.5 is a denial-of-service vulnerability in the dnspython library, specifically in the dns.name.from_wire_parser() function used for DNS name decompression. The flaw is an uncontrolled resource consumption issue triggered by a maliciously crafted DNS message. Applications that process untrusted DNS wire form messages with dnspython can be affected when an attacker supplies a specially constructed DNS name that causes the parser to consume excessive CPU while decompressing the name. The attack vector is network-based, requires low complexity, and does not require authentication, user interaction, or special privileges, meaning a remote attacker can exploit it by sending crafted DNS traffic to a vulnerable service. The primary business impact is availability degradation, because excessive CPU usage can slow or exhaust processing capacity, potentially causing denial of service for DNS-dependent operations. The affected software is dnspython (pip) versions < 2.9.0, which are subject to this excessive CPU behavior. The vulnerability does not imply direct data disclosure or integrity compromise, but it can disrupt services that rely on reliable DNS parsing and can amplify operational risk in environments where untrusted DNS input is processed.
We recommend you to update dnspython to version 2.9.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]