{"id":"CVE-2026-114605","aliases":["GHSA-45c3-73f7-pv4m"],"title":"dnspython dns.name.from_wire_parser() excessive CPU use","summary":"dnspython dns.name.from_wire_parser() excessive CPU use","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"dnspython","product":"dnspython","ecosystem":"pip","affected":["dnspython < 2.9.0"],"patched":["dnspython 2.9.0"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T15:47:24.143338210Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-45c3-73f7-pv4m","references":[{"url":"https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114605"},{"url":"https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023"},{"url":"https://github.com/rthalley/dnspython"},{"url":"https://github.com/rthalley/dnspython/releases/tag/v2.9.0"},{"url":"https://github.com/advisories/GHSA-45c3-73f7-pv4m"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114605.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114605"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559128"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114605"}],"tags":["osv","pip","ghsa","csaf","vex","red-hat","cve.org"],"epss":0.00335,"epssPercentile":0.26673,"cwe":["CWE-674","CWE-606"],"ingestedAt":"2026-10-22T22:00:50.345Z","slug":"CVE-2026-114605","body":"## Overview\n\n### Impact\nA maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression.  Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required.\n\n### Patches\nThis problem is fixed in dnspython 2.9.0.\n\n### Workarounds\nThere are no known workarounds.\n\n### Credit\nEvgenios Gkritsis, Department of Informatics, University of Piraeus & Athena Research Center, Greece\nConstantinos Patsakis, Department of Informatics, University of Piraeus & Athena Research Center, Greece\nGeorge Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece\n\n## Affected packages\n\n- `dnspython < 2.9.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `dnspython 2.9.0`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Red Hat AI Inference Server, … · no fix planned: Ansible Automation Orchestrator 2026, Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114605.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}