OESA-2026-4674: python-dns security update
\ Security Fix(es):
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.(CVE-2026-114605)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/python-dnsto a version that resolves this vulnerability.Fixed in 2.4.2-5.oe2403sp3 - Upgrade
Upgrade
dnspythonto a version that resolves this vulnerability.Fixed in 2.9.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using dnspython before 2.9.0 to process untrusted DNS wire-format messages are exposed. The affected package is openeuler/python-dns.
What does an attacker need to exploit the vulnerability?
An attacker needs to provide a malicious DNS wire-format message containing attacker-controlled compression pointer chains. No privileges or user interaction are required.
What is the impact of successful exploitation?
The crafted message can cause excessive DNS name-decompression pointer traversal, resulting in high CPU consumption, application degradation, or denial of service.
What version fixes the issue?
The issue is fixed in dnspython version 2.9.0.