Excessive CPU use in dnspython DNS name parsing
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 18 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.
Summary
dnspython versions before 2.9.0 contain a flaw in dns.name.from_wire_parser() where DNS name decompression follows compression pointer chains without a hop limit, an uncontrolled recursion issue (CWE-674). A remote attacker who sends a malicious DNS wire-format message can force excessive pointer traversal, causing high CPU use and denial of service in applications that process untrusted DNS messages.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rthalley | dnspython | before 2.9.0 | 2.9.0 | Patch available | CNA |
| — | dnspython (PyPI) | before 2.9.0 | 2.9.0 | Patch available | GHSA-45c3-73f7-pv4m |
- dnspython Vendorrthalley Affected before 2.9.0 Fixed in 2.9.0 Patch available CNA
- dnspython (PyPI) Vendor— Affected before 2.9.0 Fixed in 2.9.0 Patch available GHSA-45c3-73f7-pv4m
Remediation
Upgrade dnspython to version 2.9.0, which fixes the issue on PyPI. Red Hat fixes it in RHSA-2026:94749 for python-dns on Red Hat Enterprise Linux BaseOS (v. 8), and in RHSA-2026:95261 and RHSA-2026:95267 for Red Hat Trusted Artifact Signer 1.5. Red Hat's plan is none_available for Ansible Automation Orchestrator 2026, Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA dnspython (rthalley) Fixed in 2.9.0
- Fix · GHSA-45c3-73f7-pv4m dnspython (PyPI) Fixed in 2.9.0 Advisory →
Red Hat 5 advisories
- RHSA-2026:95267 Released 2026-11-04 · Red Hat rating CriticalRHTAS 1.5.1 - Tech Preview Release Of the Sigstore A2A 0.0.2
- Red Hat Trusted Artifact Signer 1.5 registry.redhat.io/rhtas/rh-sigstore-a2a-rhel9
- RHSA-2026:95261 Released 2026-11-04 · Red Hat rating CriticalRHTAS 1.5.1 - Release of Model Transparency 1.0.6
- Red Hat Trusted Artifact Signer 1.5 registry.redhat.io/rhtas/model-transparency-rhel9
- RHSA-2026:94749 Released 2026-11-03 · Red Hat rating Importantpython-dns security update
- Red Hat Enterprise Linux BaseOS (v. 8) python-dns-1.15.0-13.el8_10, python3-dns-1.15.0-13.el8_10
Show 2 more Red Hat advisories
- RHSA-2026:92667 Released 2026-10-29 · Red Hat rating Criticalsatellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
- RHSA-2026:92666 Released 2026-10-29 · Red Hat rating Criticalsatellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.19 registry.redhat.io/satellite/foreman-mcp-server-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet |
| Exploit Intelligence | Affected | No fix yet |
| Lightspeed Core | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:94749 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:92667 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:92666 |
| Red Hat Trusted Artifact Signer 1.5 | Fixed | RHSA-2026:95261, RHSA-2026:95267 |
Not affected: 3 products
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux command line assistant
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-22 Threatist record created from CVE-2026-114605
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-23 CVSS score added · Red Hat
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-24 Affected versions changed · Red Hat
- 2026-10-26 Affected versions changed · Red Hat
- 2026-10-27 Alias added: GHSA-45c3-73f7-pv4m
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92666 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92667 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94749 · Red Hat
- 2026-11-04 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
- 2026-11-05 Fix available: Red Hat Trusted Artifact Signer 1.5 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95261 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95267 · Red Hat
References
Sources
- CVE-2026-114605 · CVE Program
- CVE-2026-114605 · NVD
- FIRST EPSS
- GHSA-45c3-73f7-pv4m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-114605 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences