{"id":"CVE-2026-128089","kind":"vulnerability","aliases":["CVE-2026-128089","GHSA-vvf4-9x63-8xvv"],"related":[],"title":"dnspython has excessive memory and CPU use","description":"### Summary\n\nA maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.\n\n### Details\n\nThe `from_text()` parser does not check that a WKS record service number is between 0 and 65535 inclusive.  It then uses this number to resize the bitmap to accommodate a bit with that offset.  This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.\n\n### Proof of concept\n\nThis demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.\n\n```\nrd = dns.rdata.from_text(\"IN\", \"WKS\", \"10.0.0.1 udp 65536\")\n```\n\n### Impact\n\nIf dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.","summary":"A malicious zone file containing a WKS DNS record with an out-of-range service number makes dnspython's parser allocate huge amounts of memory and burn CPU. An attacker who controls zone file contents can crash or stall the process that parses it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dnspython","fixed":["2.9.2"],"affected":"< 2.9.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-400","cwe-770","dns","dnspython","package","python"],"not_affected_if":["no-untrusted-zone-input","queries-only"],"how_to_check":"- Check the installed version with `pip show dnspython` and see whether it is below `2.9.2`.\n- Search your code for `dns.zone` or `dns.rdata.from_text` calls that read zone text from untrusted sources.","fix":"- Upgrade dnspython to `2.9.2` or later.","status":"open","published_at":"2026-11-13T20:18:55+00:00","first_seen_at":"2026-11-13T20:23:42+00:00","triaged_at":"2026-11-13T20:24:58+00:00","updated_at":"2026-11-13T20:34:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T20:24:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade dnspython to `2.9.2` or later.","reach":"unknown","title":"dnspython: crafted WKS record in zone file exhausts memory and CPU","impact":"medium","summary":"A malicious zone file containing a WKS DNS record with an out-of-range service number makes dnspython's parser allocate huge amounts of memory and burn CPU. An attacker who controls zone file contents can crash or stall the process that parses it.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","dnspython","dns"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Process exhausts memory or CPU, causing denial of service.","analyst_note":"","how_to_check":"- Check the installed version with `pip show dnspython` and see whether it is below `2.9.2`.\n- Search your code for `dns.zone` or `dns.rdata.from_text` calls that read zone text from untrusted sources.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-zone-input","queries-only"],"who_is_affected":"Applications that parse zone file format or DNS rdata text supplied by someone outside the team, such as user-uploaded zone files or imported zone data. Applications that only use dnspython for queries against trusted resolvers, or that never parse untrusted zone text, are much less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4865,"output_tokens":516,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128089':10A,18A '-2026':9A,17A '-400':21B '-770':23B '0':115C '10.0.0.1':181C '65535':117C '65536':183C '8xvv':15A '9x63':14A 'accommod':129C 'alloc':49B,141C 'also':143C 'amount':51B 'array':146C 'attack':58B,195C 'bit':131C 'bitmap':127C 'burn':55B 'caus':90C,137C,170C 'check':106C 'concept':153C 'consum':84C,206C 'consumpt':175C 'contain':32B 'content':63B 'control':60B,197C 'could':78C 'cpu':6A,56B,88C,150C,174C,210C 'craft':75C 'crash':65B 'cve':8A,16A 'cwe':20B,22B 'demonstr':155C 'deni':211C 'detail':99C 'dns':24B,35B 'dns.rdata.from':177C 'dnspython':1A,19A,25B,46B,186C 'due':95C 'excess':3A,85C,171C,207C 'exhaust':98C 'exit':94C 'extend':144C 'extrem':138C 'failur':157C 'file':31B,62B,77C 'format':192C 'ghsa':12A 'ghsa-vvf4-9x63-8xvv':11A 'huge':50B 'impact':184C 'inclus':118C 'ineffici':148C 'larg':139C 'limit':159C 'make':45B 'malici':29B,74C 'may':205C 'memori':4A,53B,86C,97C,140C,172C,208C 'number':44B,112C,123C,162C 'offset':134C 'out-of-rang':39B 'packag':26B 'pars':71B 'parser':48B,103C 'possibl':89C 'process':69B,92C 'program':204C 'proof':151C 'python':27B 'rang':42B 'rd':176C 'rdata':201C 'read':190C 'record':36B,82C,110C 'resiz':125C 'servic':43B,111C,161C,212C 'stall':67B 'summari':72C 'text':102C,178C,202C 'though':163C 'type':199C 'udp':182C 'use':7A,79C,121C,188C 'valu':166C 'vvf4':13A 'wast':149C 'wks':34B,81C,109C,180C 'zone':30B,61B,76C 'zonefil':191C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse zone file format or DNS rdata text supplied by someone outside the team, such as user-uploaded zone files or imported zone data. Applications that only use dnspython for queries against trusted resolvers, or that never parse untrusted zone text, are much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["dnspython"],"ptokens":["dnspython"],"labels":["cwe400","cwe770","dns","dnspython","high","package","pypi","python"],"campaign_type":null,"search_a":"'-128089':10A,18A '-2026':9A,17A '8xvv':15A '9x63':14A 'cpu':6A 'cve':8A,16A 'dnspython':1A,19A 'excess':3A 'ghsa':12A 'ghsa-vvf4-9x63-8xvv':11A 'memori':4A 'use':7A 'vvf4':13A","search_b":"'-400':21B '-770':23B 'alloc':49B 'amount':51B 'attack':58B 'burn':55B 'contain':32B 'content':63B 'control':60B 'cpu':56B 'crash':65B 'cwe':20B,22B 'dns':24B,35B 'dnspython':25B,46B 'file':31B,62B 'huge':50B 'make':45B 'malici':29B 'memori':53B 'number':44B 'out-of-rang':39B 'packag':26B 'pars':71B 'parser':48B 'process':69B 'python':27B 'rang':42B 'record':36B 'servic':43B 'stall':67B 'wks':34B 'zone':30B,61B","search_c":"'0':115C '10.0.0.1':181C '65535':117C '65536':183C 'accommod':129C 'alloc':141C 'also':143C 'array':146C 'attack':195C 'bit':131C 'bitmap':127C 'caus':90C,137C,170C 'check':106C 'concept':153C 'consum':84C,206C 'consumpt':175C 'control':197C 'could':78C 'cpu':88C,150C,174C,210C 'craft':75C 'demonstr':155C 'deni':211C 'detail':99C 'dns.rdata.from':177C 'dnspython':186C 'due':95C 'excess':85C,171C,207C 'exhaust':98C 'exit':94C 'extend':144C 'extrem':138C 'failur':157C 'file':77C 'format':192C 'impact':184C 'inclus':118C 'ineffici':148C 'larg':139C 'limit':159C 'malici':74C 'may':205C 'memori':86C,97C,140C,172C,208C 'number':112C,123C,162C 'offset':134C 'parser':103C 'possibl':89C 'process':92C 'program':204C 'proof':151C 'rd':176C 'rdata':201C 'read':190C 'record':82C,110C 'resiz':125C 'servic':111C,161C,212C 'summari':72C 'text':102C,178C,202C 'though':163C 'type':199C 'udp':182C 'use':79C,121C,188C 'valu':166C 'wast':149C 'wks':81C,109C,180C 'zone':76C 'zonefil':191C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-04T00:04:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vvf4-9x63-8xvv","url":"https://github.com/advisories/GHSA-vvf4-9x63-8xvv","severity":"high","published_at":"2026-11-13T20:19:13+00:00","modified_at":"2026-11-13T20:19:16+00:00","first_seen_at":"2026-11-13T20:23:42+00:00","fetched_at":"2026-11-13T20:33:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-128089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128089","severity":null,"published_at":"2026-11-13T20:18:55+00:00","modified_at":"2026-11-13T20:18:55+00:00","first_seen_at":"2026-11-13T20:34:44+00:00","fetched_at":"2026-11-13T20:34:44+00:00","note":null}],"documents":[{"id":149247,"url":"https://api.github.com/repos/rthalley/dnspython/security-advisories/GHSA-vvf4-9x63-8xvv","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":149248,"url":"https://github.com/rthalley/dnspython/security/advisories/GHSA-vvf4-9x63-8xvv","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-04T00:04:35+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":149249,"url":"https://github.com/rthalley/dnspython/commit/388db14ee9923288f6e73f86e482c77706e59d73","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":149250,"url":"https://github.com/rthalley/dnspython/commit/a62e1be066da0ed71b5b59f37435bb17cfa0070f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":149251,"url":"https://github.com/rthalley/dnspython/releases/tag/v2.9.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}