---
id: CVE-2026-114605
title: dnspython dns.name.from_wire_parser() excessive CPU use
summary: >-
  dnspython is a DNS toolkit for Python. Prior to 2.9.0,
  dns.name.from_wire_parser follows attacker-controlled DNS compression pointer
  chains without a hop limit. A malicious DNS wire-format message can force
  excessive pointer traversal du…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-674
  - CWE-606
vendor: rthalley
product: dnspython
affected:
  - dnspython < 2.9.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-29T02:18:51.388509Z'
published: '2026-10-22'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T02:19:02.339Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114605'
references:
  - url: >-
      https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
    label: >-
      https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
  - url: >-
      https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023
    label: >-
      https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023
  - url: 'https://github.com/rthalley/dnspython/releases/tag/v2.9.0'
    label: 'https://github.com/rthalley/dnspython/releases/tag/v2.9.0'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114605'
  - url: 'https://github.com/rthalley/dnspython'
  - url: 'https://github.com/advisories/GHSA-45c3-73f7-pv4m'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114605.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114605'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2559128'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-114605'
tags:
  - cve.org
  - osv
  - pip
  - ghsa
  - csaf
  - vex
  - red-hat
epss: 0.00335
epssPercentile: 0.26839
aliases:
  - GHSA-45c3-73f7-pv4m
ecosystem: pip
patched:
  - dnspython 2.9.0
ingestedAt: '2026-10-22T22:00:50.345Z'
---

## Overview

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

## Affected

- `dnspython < 2.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-114605)

Affected packages:

- `dnspython < 2.9.0`

Patched in:

- `dnspython 2.9.0`

Source: https://osv.dev/vulnerability/GHSA-45c3-73f7-pv4m

## Vendor advisories

- **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Red Hat AI Inference Server, … · no fix planned: Ansible Automation Orchestrator 2026, Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114605.json)