---
id: "CVE-2026-114605"
kind: "vulnerability"
aliases: ["CVE-2026-114605"]
title: "dnspython: unbounded DNS compression pointers let a message stall parsing"
severity: "high"
cvss: 7.5
epss: 0.00339
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns-servers", "dnspython", "package", "python"]
not_affected_if: ["dnspython-2.9.0-or-later", "trusted-input-only"]
published_at: "2026-10-22T17:16:58+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:15:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114605", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114605", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# dnspython: unbounded DNS compression pointers let a message stall parsing

dnspython versions before 2.9.0 follow DNS name compression pointers in attacker-supplied messages without a hop limit. A crafted DNS wire-format message can force excessive pointer traversal, pinning CPU and degrading or denying service in applications that parse untrusted DNS responses or queries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show dnspython` or `python -c "import dns; print(dns.version.version)"`.
- Look for applications that parse DNS messages from untrusted sources, such as resolvers, proxies or DNS servers built on dnspython.

## Fix

- Upgrade dnspython to `2.9.0` or later with `pip install --upgrade dnspython>=2.9.0`.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114605
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114605

## From the sources

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_