{"id":"CVE-2026-114605","kind":"vulnerability","aliases":["CVE-2026-114605"],"related":[],"title":"dnspython: unbounded DNS compression pointers let a message stall parsing","description":"dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.","summary":"dnspython versions before 2.9.0 follow DNS name compression pointers in attacker-supplied messages without a hop limit. A crafted DNS wire-format message can force excessive pointer traversal, pinning CPU and degrading or denying service in applications that parse untrusted DNS responses or queries.","severity":"high","cvss":7.5,"epss":0.00339,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-servers","dnspython","package","python"],"not_affected_if":["dnspython-2.9.0-or-later","trusted-input-only"],"how_to_check":"- Check the installed version with `pip show dnspython` or `python -c \"import dns; print(dns.version.version)\"`.\n- Look for applications that parse DNS messages from untrusted sources, such as resolvers, proxies or DNS servers built on dnspython.","fix":"- Upgrade dnspython to `2.9.0` or later with `pip install --upgrade dnspython>=2.9.0`.","status":"open","published_at":"2026-10-22T17:16:58+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:15:09+00:00","updated_at":"2026-10-25T03:15:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:15:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade dnspython to `2.9.0` or later with `pip install --upgrade dnspython>=2.9.0`.","reach":"network","title":"dnspython: unbounded DNS compression pointers let a message stall parsing","impact":"medium","summary":"dnspython versions before 2.9.0 follow DNS name compression pointers in attacker-supplied messages without a hop limit. A crafted DNS wire-format message can force excessive pointer traversal, pinning CPU and degrading or denying service in applications that parse untrusted DNS responses or queries.","category":"package","nicknames":[],"who_cares":["python","dnspython","dns-servers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker stalls parsing and causes CPU exhaustion or denial of service","analyst_note":"","how_to_check":"- Check the installed version with `pip show dnspython` or `python -c \"import dns; print(dns.version.version)\"`.\n- Look for applications that parse DNS messages from untrusted sources, such as resolvers, proxies or DNS servers built on dnspython.","needs_analyst":false,"not_affected_if":["trusted-input-only","dnspython-2.9.0-or-later"],"who_is_affected":"Applications built on dnspython before 2.9.0 that decode DNS messages from untrusted networks, for example a DNS server, proxy or scanner that accepts arbitrary packets. Code that only resolves names against trusted servers or never handles attacker-supplied wire-format messages is much less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000623,"input_tokens":3379,"output_tokens":571,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114605':13A,16A '-2026':12A,15A '2.9.0':26B,78C,132C 'applic':61B,113C,120C 'attack':34B,84C 'attacker-control':83C 'attacker-suppli':33B 'caus':109C 'chain':89C 'compress':4A,30B,87C 'control':85C 'cpu':54B,111C 'craft':42B 'cve':11A,14A 'decompress':108C 'degrad':56B,114C 'deni':58B 'denial':116C 'dns':3A,18B,28B,43B,65B,72C,86C,96C,124C 'dns-server':17B 'dns.name.from':79C 'dnspython':1A,20B,23B,69C 'excess':50B,103C 'fix':129C 'follow':27B,82C 'forc':49B,102C 'format':46B,99C 'high':110C 'hop':39B,92C 'issu':127C 'let':6A 'limit':40B,93C 'malici':95C 'messag':8A,36B,47B,100C,125C 'name':29B,107C 'packag':21B 'pars':10A,63B 'parser':81C 'pin':53B 'pointer':5A,31B,51B,88C,104C 'prior':76C 'process':122C 'python':22B,75C 'queri':68B 'respons':66B 'server':19B 'servic':59B,118C 'stall':9A 'suppli':35B 'toolkit':73C 'travers':52B,105C 'unbound':2A 'untrust':64B,123C 'use':112C 'version':24B,131C 'wire':45B,80C,98C 'wire-format':44B,97C 'without':37B,90C","nicknames":[],"mitigations":[],"who_affected":"Applications built on dnspython before 2.9.0 that decode DNS messages from untrusted networks, for example a DNS server, proxy or scanner that accepts arbitrary packets. Code that only resolves names against trusted servers or never handles attacker-supplied wire-format messages is much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T17:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114605","severity":null,"published_at":"2026-10-22T17:16:58+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114605","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114605","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}