Live › vulnerability › CVE-2026-114605
Go to dashboarddnspython versions before 2.9.0 follow DNS name compression pointers in attacker-supplied messages without a hop limit. A crafted DNS wire-format message can force excessive pointer traversal, pinning CPU and degrading or denying service in applications that parse untrusted DNS responses or queries.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on dnspython before 2.9.0 that decode DNS messages from untrusted networks, for example a DNS server, proxy or scanner that accepts arbitrary packets. Code that only resolves names against trusted servers or never handles attacker-supplied wire-format messages is much less exposed.
No product ranges from the sources yet.
pip show dnspython or python -c "import dns; print(dns.version.version)".2.9.0 or later with pip install --upgrade dnspython>=2.9.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114605")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.