CVE-2026-114605 in dnspython
Summary
by MITRE • 10/22/2026
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The dnspython library serves as a fundamental Domain Name System toolkit for the Python programming language, widely utilized by developers to construct and parse DNS queries and responses within networked applications. A critical security flaw was identified in versions prior to 2.9.0 regarding the handling of DNS wire-format messages, specifically within the dns.name.from_wire_parser function. This component is responsible for decompressing domain names encoded using DNS compression pointers, a standard mechanism defined in RFC 1035 that allows efficient representation of repeated labels within DNS packets by referencing previous occurrences rather than repeating full strings. The vulnerability stems from the parser's failure to enforce a hop limit when traversing these attacker-controlled pointer chains. In a properly implemented parser, there must be a maximum depth or iteration count for following pointers to prevent infinite loops; however, in this affected version, the code blindly follows each pointer without tracking how many hops have been taken or checking against a predefined threshold.
This technical flaw allows an adversary to craft malicious DNS wire-format messages containing deeply nested or circular compression pointers. When such a message is processed by an application using the vulnerable dnspython library, the parser enters an excessive traversal loop while attempting to decompress the name field. Because there is no mechanism to detect cycles or limit recursion depth, the CPU resources are consumed indefinitely as the system attempts to resolve the pointer chain. This behavior constitutes a classic algorithmic complexity vulnerability where input manipulation leads to resource exhaustion. The operational impact of this flaw is severe for any service that processes untrusted DNS traffic, such as recursive resolvers, authoritative name servers, or applications performing dynamic DNS updates. An attacker can exploit this condition to trigger a denial of service by causing the application thread to hang indefinitely or consume all available CPU cycles on the host system, thereby degrading performance for legitimate users and potentially crashing the service entirely.
From a classification perspective, this vulnerability aligns with CWE-675, which describes operations that are not limited by user-controlled iteration limits, leading to resource exhaustion. It also maps directly to MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via Resource Exhaustion Attacks, where the attacker leverages inefficient handling of input data to disrupt service availability. The root cause is a lack of validation on the structural integrity and depth of the DNS compression pointer chain before processing it for decompression. This oversight violates the principle of defensive programming which dictates that all external inputs must be validated against expected bounds and structures, particularly when dealing with network protocols that are inherently untrusted by default.
To mitigate this risk, organizations relying on dnspython must immediately upgrade to version 2.9.0 or later, where the from_wire_parser function has been patched to enforce a strict hop limit during pointer traversal. This fix ensures that if a compression chain exceeds a safe number of hops, the parser will abort and raise an error rather than entering an infinite loop. In addition to upgrading the library, developers should implement network-level filtering to restrict DNS traffic sources to trusted resolvers where possible, reducing the attack surface for malformed packet injection. Furthermore, application-layer monitoring can be employed to detect anomalies in CPU usage or response times that may indicate ongoing exploitation attempts of similar algorithmic complexity vulnerabilities across other components within the infrastructure. Regular security audits and dependency updates are essential practices to maintain resilience against such protocol-level abuse vectors.