---
id: "CVE-2026-128089"
page: "https://infrastack.ai/live/CVE-2026-128089"
kind: "vulnerability"
aliases: ["CVE-2026-128089", "GHSA-vvf4-9x63-8xvv"]
title: "dnspython has excessive memory and CPU use"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "dnspython", "fixed": ["2.9.2"], "affected": "< 2.9.2", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-400", "cwe-770", "dns", "dnspython", "package", "python"]
not_affected_if: ["no-untrusted-zone-input", "queries-only"]
published_at: "2026-11-13T20:18:55+00:00"
first_seen_at: "2026-11-13T20:23:42+00:00"
updated_at: "2026-11-13T20:34:44+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-vvf4-9x63-8xvv", "first_seen_at": "2026-11-13T20:23:42+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128089", "first_seen_at": "2026-11-13T20:34:44+00:00"}]
exploit_sources: []
---

# dnspython has excessive memory and CPU use

Link for people: https://infrastack.ai/live/CVE-2026-128089 (this .md is for agents)

A malicious zone file containing a WKS DNS record with an out-of-range service number makes dnspython's parser allocate huge amounts of memory and burn CPU. An attacker who controls zone file contents can crash or stall the process that parses it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:dnspython affected < 2.9.2 fixed 2.9.2

## How to check

- Check the installed version with `pip show dnspython` and see whether it is below `2.9.2`.
- Search your code for `dns.zone` or `dns.rdata.from_text` calls that read zone text from untrusted sources.

## Fix

- Upgrade dnspython to `2.9.2` or later.

## Timeline

- 2026-11-13T20:23:42+00:00 ghsa https://github.com/advisories/GHSA-vvf4-9x63-8xvv
- 2026-11-13T20:34:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128089

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/rthalley/dnspython/security-advisories/GHSA-vvf4-9x63-8xvv
- [advisory] Maintainer's advisory: github.com https://github.com/rthalley/dnspython/security/advisories/GHSA-vvf4-9x63-8xvv
- [fix] Patch: github.com https://github.com/rthalley/dnspython/commit/388db14ee9923288f6e73f86e482c77706e59d73
- [fix] Patch: github.com https://github.com/rthalley/dnspython/commit/a62e1be066da0ed71b5b59f37435bb17cfa0070f
- [fix] Release: github.com https://github.com/rthalley/dnspython/releases/tag/v2.9.2

## From the sources

### Summary

A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.

### Details

The `from_text()` parser does not check that a WKS record service number is between 0 and 65535 inclusive.  It then uses this number to resize the bitmap to accommodate a bit with that offset.  This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.

### Proof of concept

This demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.

```
rd = dns.rdata.from_text("IN", "WKS", "10.0.0.1 udp 65536")
```

### Impact

If dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_