Bug 2559128 (CVE-2026-114605)

Summary:	CVE-2026-114605 dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, alinfoot, anthomas, aos-team-art-private, asdas, bbrownin, blitton, dfreiber, dkeler, dpaolell, drow, dschmidt, dtrifiro, dymurray, eborisov, ebourniv, eglynn, ehelms, ggainey, hasun, ibolton, jburrell, jdelft, jjoyce, jlanda, jmatthew, jmontleo, jpasqual, jpretori, jschluet, jupierce, juwatts, kshier, lball, lgarciaa, lhh, mbarnett, mbiarnes, mburns, mdellweg, mgarciac, mhayden, mhulan, mwoodson, ngough, nmoumoul, nyancey, osousa, pcreech, pgaikwad, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, rhel-process-autobot, rjohnson, sbunciak, sdoran, sghai, sidsharm, simaishi, slucidi, smallamp, sseago, stcannon, suppawar, thason, tmalecek, veshanka, vkumar, vlaad, watson-tool-maintainers, weaton, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in dnspython. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted Domain Name System (DNS) message containing excessive compression pointer chains. Because the parser does not enforce a hop limit during name decompression, processing these malformed messages leads to excessive CPU utilization and application unresponsiveness.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-22 16:43:13 UTC

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

Comment 2 Jon Orris 2026-11-03 20:26:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:94749 https://access.redhat.com/errata/RHSA-2026:94749