GHSA-vvf4-9x63-8xvv

Suggest an improvement
Source
https://github.com/advisories/GHSA-vvf4-9x63-8xvv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-vvf4-9x63-8xvv/GHSA-vvf4-9x63-8xvv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vvf4-9x63-8xvv
Aliases
  • CVE-2026-128089
Published
2026-11-13T20:19:13Z
Modified
2026-11-13T20:30:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
dnspython has excessive memory and CPU use
Details

Summary

A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.

Details

The from_text() parser does not check that a WKS record service number is between 0 and 65535 inclusive. It then uses this number to resize the bitmap to accommodate a bit with that offset. This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.

Proof of concept

This demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.

rd = dns.rdata.from_text("IN", "WKS", "10.0.0.1 udp 65536")

Impact

If dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-13T20:19:13Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

PyPI / dnspython

Package

Name
dnspython
View open source insights on deps.dev
Purl
pkg:pypi/dnspython

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.2

Affected versions

1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.5.0
1.6.0
1.7.1
1.8.0
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.15.0
1.16.0
2.*
2.0.0rc1
2.0.0rc2
2.0.0
2.1.0rc1
2.1.0
2.2.0rc1
2.2.0
2.2.1
2.3.0rc1
2.3.0
2.4.0rc1
2.4.0
2.4.1
2.4.2
2.5.0rc1
2.5.0
2.6.0rc1
2.6.0
2.6.1
2.7.0rc1
2.7.0
2.8.0rc1
2.8.0
2.9.0
2.9.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-vvf4-9x63-8xvv/GHSA-vvf4-9x63-8xvv.json"