dnspython dns.name.from_wire_parser() excessive CPU use
CVE-2026-114605
Impact A maliciously crafted DNS message may cause dns.name.fromwireparser() to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required. Patches This problem is fixed in dnspython 2.9.0. Workarounds There are no known workarounds. Credit Evgenios Gkritsis, Department of Informatics, University of Piraeus & Athena Research Center, Greece Constantinos Patsakis, Department of Informatics, University of Piraeus & Athena Research Center, Greece George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece
Assessment
- CVSS
- 7.5 (v3.1)
- Severity
- High
- EPSS
- 0.00335% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 27 October 2026
- Last updated
- 27 October 2026
- Affected
- pip · dnspython
- Weakness
- CWE-674
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
At the source
References
- https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
- https://nvd.nist.gov/vuln/detail/CVE-2026-114605
- https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023
- https://github.com/rthalley/dnspython/releases/tag/v2.9.0
- https://github.com/advisories/GHSA-45c3-73f7-pv4m
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-114605