CVE-2026-114605

Public on 2026-10-22
Modified on 2026-10-23
Description
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core bind Not Affected
Amazon Linux 2023 bind Not Affected
Amazon Linux 2027 Preview bind Not Affected
Amazon Linux 2 - Core libvirt Not Affected
Amazon Linux 2023 libvirt Not Affected
Amazon Linux 2027 Preview libvirt Not Affected
Amazon Linux 2 - Core python-dns Pending Fix
Amazon Linux 2023 python-dns Pending Fix
Amazon Linux 2027 Preview python-dns Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H