GHSA-45c3-73f7-pv4m

Suggest an improvement
Source
https://github.com/advisories/GHSA-45c3-73f7-pv4m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-45c3-73f7-pv4m
Aliases
Published
2026-10-27T15:37:37Z
Modified
2026-10-27T15:47:24Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
dnspython dns.name.from_wire_parser() excessive CPU use
Details

Impact

A maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required.

Patches

This problem is fixed in dnspython 2.9.0.

Workarounds

There are no known workarounds.

Credit

Evgenios Gkritsis, Department of Informatics, University of Piraeus & Athena Research Center, Greece Constantinos Patsakis, Department of Informatics, University of Piraeus & Athena Research Center, Greece George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece

Database specific 
{
    "cwe_ids":  [
        "CWE-674"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-27T15:37:37Z",
    "nvd_published_at":  "2026-10-22T17:16:58Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / dnspython

Package

Name
dnspython
View open source insights on deps.dev
Purl
pkg:pypi/dnspython

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0

Affected versions

1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.5.0
1.6.0
1.7.1
1.8.0
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.10.0
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.15.0
1.16.0
2.*
2.0.0rc1
2.0.0rc2
2.0.0
2.1.0rc1
2.1.0
2.2.0rc1
2.2.0
2.2.1
2.3.0rc1
2.3.0
2.4.0rc1
2.4.0
2.4.1
2.4.2
2.5.0rc1
2.5.0
2.6.0rc1
2.6.0
2.6.1
2.7.0rc1
2.7.0
2.8.0rc1
2.8.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json"