DNSPYTHON · CVE-2026-128089 · Package
FIX → 2.9.2
A malicious zone file containing a WKS DNS record with an out-of-range service number makes dnspython's parser allocate huge amounts of memory and burn CPU. An attacker who controls zone file contents can crash or stall the process that parses it.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that parse zone file format or DNS rdata text supplied by someone outside the team, such as user-uploaded zone files or imported zone data. Applications that only use dnspython for queries against trusted resolvers, or that never parse untrusted zone text, are much less exposed.
Not affected if no-untrusted-zone-input, queries-only
Who cares dns, dnspython, python
pip show dnspython and see whether it is below 2.9.2.dns.zone or dns.rdata.from_text calls that read zone text from untrusted sources.Upgrade to 2.9.2
2.9.2 or later.A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.
The from_text() parser does not check that a WKS record service number is between 0 and 65535 inclusive. It then uses this number to resize the bitmap to accommodate a bit with that offset. This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.
This demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.
rd = dns.rdata.from_text("IN", "WKS", "10.0.0.1 udp 65536")
If dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.