CVE-2026-45409Medium· 5.3▾ SunlitA flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding f…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
Last analysed / modified upstream
A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significant resources, leading to a Denial of Service (DoS), where the affected application becomes unavailable to legitimate users. This issue stems from an incomplete fix for a previously identified vulnerability.
python-idna: idna: Denial of Service via specially crafted long inputs — rated Moderate by Red Hat. Released 2026-06-05, updated 2026-09-10.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54481 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54290 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54484
Workarounds / mitigations:
idna Python library should implement input validation to ensure that domain names do not exceed the standard 253-character length limit before being passed to the idna.encode() function. This operational control prevents the processing of excessively long inputs that could lead to resource exhaustion and service unavailability.Applications that pass user-controlled data directly to idna.encode() without validat…
Affected packages:
idna < 3.15Patched in:
idna 3.15Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89699Medium· 5.5kernel: nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699)
CVE-2026-80996Medium· 5.5kernel: net: l2tp: do not propagate multicast notification errors (CVE-2026-80996)
CVE-2026-82562Low· 3.7### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the …
CVE-2026-59647High· 7.5In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count
CVE-2026-10832Medium· 5.9A flaw was found in the DERDecoder class within wildfly-elytron-asn1
CVE-2026-93491High· 7.5A flaw was found in Netty's HttpServerCodec