OESA-2026-4759: python-dns security update

Q: Which applications are exposed to this issue?

Applications using dnspython before 2.9.0 that process untrusted DNS wire-format messages are exposed. The affected package is openeuler/python-dns.

Q: What does an attacker need to exploit it?

An attacker needs to provide a malicious DNS wire-format message containing attacker-controlled compression pointer chains. No privileges or user interaction are required according to the supplied severity vector.

Q: Is the impact limited to availability?

The supplied severity vector indicates no confidentiality or integrity impact and a high availability impact. Exploitation can cause excessive CPU consumption, application degradation, or denial of service.

Q: How can I remediate the issue?

Update dnspython to version 2.9.0 or later. The issue is fixed in version 2.9.0.

Published Nov 11, 2026

Updated

\ Security Fix(es):

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.(CVE-2026-114605)

Affected Software

1 affected componentFixes available

openeuler/python-dns<2.4.2-5.oe2403sp4

2.4.2-5.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/python-dns to a version that resolves this vulnerability.
Fixed in 2.4.2-5.oe2403sp4
Upgrade
Upgrade dnspython to a version that resolves this vulnerability.
Fixed in 2.9.0

Event History

Nov 11, 2026

Advisory Published

via OSV·12:25 PM

Data Sourced

via OSV·12:25 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114605

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using dnspython before 2.9.0 that process untrusted DNS wire-format messages are exposed. The affected package is openeuler/python-dns.

What does an attacker need to exploit it?

An attacker needs to provide a malicious DNS wire-format message containing attacker-controlled compression pointer chains. No privileges or user interaction are required according to the supplied severity vector.

Is the impact limited to availability?

The supplied severity vector indicates no confidentiality or integrity impact and a high availability impact. Exploitation can cause excessive CPU consumption, application degradation, or denial of service.

How can I remediate the issue?

Update dnspython to version 2.9.0 or later. The issue is fixed in version 2.9.0.

OESA-2026-4759: python-dns security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Is the impact limited to availability?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Is the impact limited to availability?

How can I remediate the issue?