PT-2026-41956 · Pypi · Idna

Published 2026-05-19 · Updated 2026-06-05 · CVE-2026-45409

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions idna versions prior to 3.14

Description A specially crafted argument passed to the idna.encode() function can consume significant system resources, potentially leading to a denial-of-service. This occurs because payloads containing specific characters, such as "u0660" * N or "u30fb" * N + "u6f22", utilize the valid contexto() function before length rejection occurs. For high values of N, the processing time increases significantly.

Recommendations Update to version 3.14 or later to ensure long inputs are rejected prior to processing. As a temporary workaround, enforce a domain name length limit of 253 characters before passing the input to the idna.encode() function.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-45409

GHSA-65PC-FJ4G-8RJX

OPENSUSE-SU-2026:10829-1

Affected Products

Idna

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-45409 · Security Note
• https://osv.dev/vulnerability/GHSA-65pc-fj4g-8rjx · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10829-1 · Vendor Advisory
• https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx · Note
• https://github.com/kjd/idna · Note
• https://t.me/cveNotify/166306 · Telegram Post
• https://twitter.com/mudrii/status/2062083462245536242 · Twitter Post
• https://suse.com/security/cve/CVE-2026-45409 · Note
• https://t.me/CVEtracker/56020 · Telegram Post