Dnspython
Monthly
Excessive CPU consumption during DNS name decompression in dnspython before 2.9.0 lets remote attackers degrade or deny service to applications that decode untrusted DNS wire-format messages. The parser function dns.name.from_wire_parser follows attacker-controlled compression pointer chains without a hop limit, so a single crafted message can force long pointer traversal; no authentication, user interaction, or non-default configuration is required once untrusted DNS data reaches the parser (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, A:H). The exposure is bounded by architecture rather than by exploit complexity: resolvers, DNS clients and any service that decodes DNS queries or responses from untrusted peers are affected, while systems that only parse trusted internal DNS data are not. No public exploit was identified at time of analysis and the issue is not in CISA KEV; the vendor-released patch is version 2.9.0, and the vendor states there are no known workarounds.
Excessive CPU consumption during DNS name decompression in dnspython before 2.9.0 lets remote attackers degrade or deny service to applications that decode untrusted DNS wire-format messages. The parser function dns.name.from_wire_parser follows attacker-controlled compression pointer chains without a hop limit, so a single crafted message can force long pointer traversal; no authentication, user interaction, or non-default configuration is required once untrusted DNS data reaches the parser (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, A:H). The exposure is bounded by architecture rather than by exploit complexity: resolvers, DNS clients and any service that decodes DNS queries or responses from untrusted peers are affected, while systems that only parse trusted internal DNS data are not. No public exploit was identified at time of analysis and the issue is not in CISA KEV; the vendor-released patch is version 2.9.0, and the vendor states there are no known workarounds.