CVE-2026-128089: dnspython has excessive memory and CPU use
Summary
A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.
Details
The fromtext() parser does not check that a WKS record service number is between 0 and 65535 inclusive. It then uses this number to resize the bitmap to accommodate a bit with that offset. This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.
Proof of concept
This demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.
rd = dns.rdata.fromtext("IN", "WKS", "10.0.0.1 udp 65536")
Impact
If dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.
Other sources
dnspython is a DNS toolkit for Python. Prior to version 2.9.2, the fromtext() parser for WKS records does not require the service number to be between 0 and 65535 before using it as a bitmap offset. An attacker-controlled zone file can supply a larger number, causing the service bitmap to grow to an extremely large size through inefficient repeated extension, consuming excessive memory and CPU and potentially terminating the process. Applications are affected only when they parse zone-file text whose record type and rdata are attacker controlled. This issue is fixed in version 2.9.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/dnspythonto a version that resolves this vulnerability.Fixed in 2.9.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.9.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using dnspython to parse zonefile-format input are exposed when an attacker can control the record type and RDATA text supplied to the parser. The affected code path is the WKS-record handling in the from_text() parser.
What does an attacker need to trigger the denial of service?
An attacker needs to provide a crafted WKS record with a service number greater than 65535. The parser uses that value as a bitmap offset, which can trigger extremely large memory allocations and inefficient CPU-intensive array growth.
Are versions before 2.9.2 affected?
Yes. Versions prior to 2.9.2 do not validate that WKS service numbers are within the allowed range of 0 through 65535 before using them as bitmap offsets.
What can be done if upgrading is not immediately possible?
Do not parse zonefile input where untrusted parties can control the record type or RDATA text. In particular, reject or constrain WKS service numbers outside the range 0 through 65535 before they reach dnspython's from_text() parser.