CVE-2026-114605

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114605
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114605.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114605
Aliases
  • GHSA-45c3-73f7-pv4m
Published
2026-10-22T16:25:32Z
Modified
2026-10-23T02:45:41Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
dnspython dns.name.from_wire_parser() excessive CPU use
Details

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114605.json"
}
References

Affected packages

Git / github.com/rthalley/dnspython

Affected ranges

Type
GIT
Repo
https://github.com/rthalley/dnspython
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e790c8f20a67ad439c7aafef2321e161c6028eee
Fixed
b485e460c266540a1a09ca6d8d1d7b685b1d3023
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.9.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "b485e460c266540a1a09ca6d8d1d7b685b1d3023"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2.9.0",
            "range":  [
                {
                    "fixed":  "e790c8f20a67ad439c7aafef2321e161c6028eee"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.10.0
v1.11.0
v1.11.1
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.7.0
v1.7.1
v1.8.0
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.4+readme
v2.*
v2.0.0
v2.0.0rc1
v2.0.0rc2
v2.1.0
v2.1.0rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114605.json"