CVE-2026-114605High· 7.5▾ Twilightdnspython dns.name.from_wire_parser() excessive CPU use
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
0.3%
Disclosed via OSV
A maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required.
This problem is fixed in dnspython 2.9.0.
There are no known workarounds.
Evgenios Gkritsis, Department of Informatics, University of Piraeus & Athena Research Center, Greece Constantinos Patsakis, Department of Informatics, University of Piraeus & Athena Research Center, Greece George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece
dnspython < 2.9.0Upgrade to a patched release:
dnspython 2.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-66393High· 7.5NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures
CVE-2026-96643High· 7.1Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
CVE-2026-112895High· 7.5Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-102999High· 7.5pypdf is a free and open-source pure-python PDF library
CVE-2026-102998High· 7.5pypdf is a free and open-source pure-python PDF library
CVE-2026-102994High· 7.5pypdf is a free and open-source pure-python PDF library