SB20261109189 - Ubuntu update for python-idna

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109189

SB20261109189 - Ubuntu update for python-idna

Published: November 9, 2026

Security Bulletin ID SB20261109189
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Resource exhaustion (CVE-ID: CVE-2026-45409)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to degrade the availability of applications that process untrusted domain names using idna.

The vulnerability exists due to costly contextual validation occurring before oversized Unicode inputs are rejected by idna.encode(). An unauthenticated remote attacker can submit specially crafted, arbitrarily long domain names to an application without preliminary input length validation, causing excessive processing time and resource consumption.


Remediation

Install update from vendor's website.

References