OESA-2026-4672: python-dns security update
\ Security Fix(es):
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.(CVE-2026-114605)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/python-dnsto a version that resolves this vulnerability.Fixed in 2.2.1-4.oe2203sp4 - Upgrade
Upgrade
dnspythonto a version that resolves this vulnerability.Fixed in 2.9.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using dnspython before version 2.9.0 that process untrusted DNS wire-format messages are exposed. The issue occurs during DNS name decompression.
What does an attacker need to exploit it?
An attacker needs to provide a malicious DNS wire-format message containing compression pointer chains that cause excessive traversal. The supplied severity vector indicates no privileges or user interaction are required.
What is the expected security impact?
The issue can cause high CPU consumption, application degradation, or denial of service. The supplied severity vector indicates availability impact only, with no confidentiality or integrity impact.
How can I determine whether my deployment is affected?
Check whether the application uses dnspython earlier than 2.9.0 and accepts or processes DNS messages from untrusted sources. Version 2.9.0 contains the fix.