Hide Forgot
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. https://github.com/python/cpython/issues/98433
Created mingw-python3 tracking bugs for this issue: Affects: fedora-all [bug 2144417] Created pypy tracking bugs for this issue: Affects: epel-7 [bug 2144426] Affects: fedora-all [bug 2144428] Created pypy3.8 tracking bugs for this issue: Affects: fedora-all [bug 2144429] Created pypy3.9 tracking bugs for this issue: Affects: fedora-all [bug 2144430] Created python2.7 tracking bugs for this issue: Affects: fedora-all [bug 2144418] Created python3.10 tracking bugs for this issue: Affects: fedora-all [bug 2144419] Created python3.11 tracking bugs for this issue: Affects: fedora-all [bug 2144420] Created python3.12 tracking bugs for this issue: Affects: fedora-all [bug 2144421] Created python3.6 tracking bugs for this issue: Affects: fedora-all [bug 2144422] Created python3.7 tracking bugs for this issue: Affects: fedora-all [bug 2144423] Created python3.8 tracking bugs for this issue: Affects: fedora-all [bug 2144424] Created python3.9 tracking bugs for this issue: Affects: fedora-all [bug 2144425] Created python34 tracking bugs for this issue: Affects: epel-all [bug 2144416]