REDHAT-BUG-2559128: High severity pypi/dnspython vulnerability

Q: Which applications are exposed to this issue?

Applications using dnspython before 2.9.0 are exposed if they process DNS wire-format messages from untrusted sources. The impact is excessive CPU consumption during DNS name decompression, which can degrade service or cause denial of service.

Q: What does an attacker need to exploit it?

An attacker needs to provide a malicious DNS wire-format message containing compression pointer chains that trigger excessive traversal. No other prerequisites are stated in the available data.

Q: What version resolves the issue?

dnspython 2.9.0 fixes the issue by addressing unbounded traversal of DNS compression pointer chains.

Published Oct 22, 2026

Updated

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

Affected Software

1 affected component

pypi/dnspython<2.9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade dnspython to a version that resolves this vulnerability.
Fixed in 2.9.0

Event History

Oct 22, 2026

Data Sourced

via Red Hat·04:43 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using dnspython before 2.9.0 are exposed if they process DNS wire-format messages from untrusted sources. The impact is excessive CPU consumption during DNS name decompression, which can degrade service or cause denial of service.

What does an attacker need to exploit it?

An attacker needs to provide a malicious DNS wire-format message containing compression pointer chains that trigger excessive traversal. No other prerequisites are stated in the available data.

What version resolves the issue?

dnspython 2.9.0 fixes the issue by addressing unbounded traversal of DNS compression pointer chains.

REDHAT-BUG-2559128: High severity pypi/dnspython vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What version resolves the issue?