Denial of Service via Quadratic Complexity in kjd/idna
Priority LOW 36CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 11 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01386 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial kjd/idna (kjd): 3.7idna (PyPI): 3.7Red Hat: 7 advisoriesRed Hat: 11 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kjd | kjd/idna | before 3.7 | 3.7 | Patch available | CNA |
| — | idna (PyPI) | before 3.7 | 3.7 | Patch available | GHSA-jjg7-2v4v-x38h |
- kjd/idna Vendorkjd Affected before 3.7 Fixed in 3.7 Patch available CNA
- idna (PyPI) Vendor— Affected before 3.7 Fixed in 3.7 Patch available GHSA-jjg7-2v4v-x38h
Remediation
- Fix · CNA kjd/idna (kjd) Fixed in 3.7
- Fix · GHSA-jjg7-2v4v-x38h idna (PyPI) Fixed in 3.7 Advisory →
Red Hat 7 advisories
- RHSA-2024:8365 Released 2024-10-23 · Red Hat rating Moderatepython-idna security update
- Red Hat Enterprise Linux Server (v. 7 ELS) python-idna-2.4-2.el7_9
- RHSA-2024:4260 Released 2024-07-02 · Red Hat rating Moderatepython-idna security update
- Red Hat Enterprise Linux BaseOS (v. 8) python-idna-2.5-7.el8_10, python3-idna-2.5-7.el8_10
- RHSA-2024:3846 Released 2024-06-11 · Red Hat rating Moderatepython-idna security update
- Red Hat Enterprise Linux BaseOS (v. 9) python-idna-2.10-7.el9_4.1, python3-idna-2.10-7.el9_4.1
Show 4 more Red Hat advisories
- RHSA-2024:3781 Released 2024-06-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.7-1.el8ap, automation-hub-4.9.2-1.el8ap, python39-aiohttp-3.9.5-1.el8ap +25
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.7-1.el9ap, automation-hub-4.9.2-1.el9ap, python-aiohttp-3.9.5-1.el9ap +25
- RHSA-2024:3543 Released 2024-06-03 · Red Hat rating Moderatepython-idna security and bug fix update
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) python-idna-2.5-5.el8_8.1, python3-idna-2.5-5.el8_8.1
- RHSA-2024:3552 Released 2024-06-03 · Red Hat rating Moderatepython-idna security and bug fix update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-idna-2.5-5.el8_6.1, python3-idna-2.5-5.el8_6.1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) python-idna-2.5-5.el8_6.1, python3-idna-2.5-5.el8_6.1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) python-idna-2.5-5.el8_6.1, python3-idna-2.5-5.el8_6.1
- RHSA-2024:3466 Released 2024-05-29 · Red Hat rating Importantpython39:3.9 and python39-devel:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.9.0+19644+d68f775d.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
- Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Update Infrastructure 4 for Cloud Providers | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:3781 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:3781 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3466 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:4260 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:3846 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2024:3552 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2024:3552 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:3543 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2024:3552 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:3466 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2024:8365 |
Not affected: 4 products
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Enterprise Linux 10
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3651
- 2026-10-03 Alias added: GHSA-jjg7-2v4v-x38h
References
Other 8
- https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h
- https://github.com/kjd/idna
- https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml
- https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2
- https://lists.fedoraproject.org/archives/list/[email protected]/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D
- https://lists.fedoraproject.org/archives/list/[email protected]/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43
More kjd Internationalized Domain Names In Applications vulnerabilities
- TI-2026-33198 Regular expression denial of service in kjd idna CVSS 4.0MEDIUM 6.9
Sources
- CVE-2024-3651 · CVE Program
- CVE-2024-3651 · NVD
- FIRST EPSS
- GHSA-jjg7-2v4v-x38h · GitHub Advisory Database · CC BY 4.0
- CVE-2024-3651 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences