dnspython CVE-2026-114605

Exploitation requires that the application pass attacker-controlled DNS wire-format data to dns.name.from_wire_parser (reached via dns.name.from_wire and general message parsing) - i.e. the application must process untrusted DNS messages, such as a resolver, DNS client, or any service that accepts and decodes DNS responses or queries from untrusted peers. No authentication, user interaction, or non-default configuration is required (AV:N/AC:L/PR:N/UI:N) once untrusted DNS input reaches the parser. The practical limiting factor is architectural: systems that only parse trusted/internal DNS data are not exposed. Affected versions are all dnspython releases prior to 2.9.0; the only fix is upgrading to 2.9.0, as the vendor advisory states there are no known workarounds.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the mechanism: a single crafted DNS wire-format message, delivered remotely without authentication or user interaction, forces unbounded compression-pointer traversal in dns.name.from_wire_parser (CWE-674, uncontrolled recursion/iteration), yielding only an availability impact - confidentiality and integrity are correctly rated N. No EPSS score was supplied, so exploitation probability cannot be quantified; this gap should be noted rather than assumed low. KEV status is not listed, so there is no confirmed active exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a high-severity DoS that is not under confirmed mass exploitation. There is no standalone weaponized exploit, but the fix commit includes a test case that demonstrates the exact triggering wire format, lowering the bar to reproduce. Net: treat as a real patch-this-week priority for any service that parses untrusted DNS messages with dnspython, but not a drop-everything emergency - the impact ceiling is resource exhaustion, not code execution or data loss.

An attacker sends, or causes a resolver/application to receive, a single malicious DNS response or message containing a chain of compression pointers that each point to the next, exceeding a reasonable hop count. When the application decodes the name with dns.name.from_wire_parser, it follows the chain without limit, consuming excessive CPU and degrading or denying service. The fix commit contains a test case with the exact crafted wire bytes demonstrating the trigger, though no independently weaponized exploit is confirmed.