---
id: CVE-2026-114605
title: dnspython dns.name.from_wire_parser() excessive CPU use
summary: >-
  dnspython is a DNS toolkit for Python. Prior to 2.9.0,
  dns.name.from_wire_parser follows attacker-controlled DNS compression pointer
  chains without a hop limit. A malicious DNS wire-format message can force
  excessive pointer traversal du…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-674
vendor: rthalley
product: dnspython
affected:
  - dnspython < 2.9.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T16:25:32.509Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114605'
references:
  - url: >-
      https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
    label: >-
      https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
  - url: >-
      https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023
    label: >-
      https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023
  - url: 'https://github.com/rthalley/dnspython/releases/tag/v2.9.0'
    label: 'https://github.com/rthalley/dnspython/releases/tag/v2.9.0'
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.345Z'
---

## Overview

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

## Affected

- `dnspython < 2.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.