SB2026110938 - Anolis OS update for python-idna
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-45409)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to degrade the availability of applications that process untrusted domain names using idna.
The vulnerability exists due to costly contextual validation occurring before oversized Unicode inputs are rejected by idna.encode(). An unauthenticated remote attacker can submit specially crafted, arbitrarily long domain names to an application without preliminary input length validation, causing excessive processing time and resource consumption.
2) Resource exhaustion (CVE-ID: CVE-2024-3651)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the idna.encode() function. A remote attacker can pass an overly long domain name to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.