OESA-2026-4673: python-dns security update
\ Security Fix(es):
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.(CVE-2026-114605)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/python-dnsto a version that resolves this vulnerability.Fixed in 2.4.2-5.oe2403sp1 - Upgrade
Upgrade
dnspythonto a version that resolves this vulnerability.Fixed in 2.9.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using dnspython to process untrusted DNS wire-format messages are exposed. The impact is excessive CPU consumption during DNS name decompression, which can degrade the application or cause denial of service.
What does an attacker need to exploit the vulnerability?
An attacker needs to provide a malicious DNS wire-format message containing compression pointer chains. No privileges or user interaction are required according to the supplied CVSS vector.
Are versions before 2.9.0 affected?
Yes. The issue affects dnspython versions prior to 2.9.0 and is fixed in version 2.9.0.