CVE-2026-114605: dnspython dns.name.from_wire_parser() excessive CPU use

October 27, 2026

A maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS’d by the extra CPU use required.

References

github.com/advisories/GHSA-45c3-73f7-pv4m
github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023
github.com/rthalley/dnspython/releases/tag/v2.9.0
github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
nvd.nist.gov/vuln/detail/CVE-2026-114605

Code Behaviors & Features

Detect and mitigate CVE-2026-114605 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →