Resource exhaustion in idna - CVE-2026-45409

Vulnerability identifier: #VU162641

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-45409

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an unauthenticated remote attacker to degrade the availability of applications that process untrusted domain names using idna.

The vulnerability exists due to costly contextual validation occurring before oversized Unicode inputs are rejected by idna.encode(). An unauthenticated remote attacker can submit specially crafted, arbitrarily long domain names to an application without preliminary input length validation, causing excessive processing time and resource consumption.

idna
Anolis OS
openEuler
Ubuntu
Fedora
python3-idna (Ubuntu package)
python3-idna
python-idna
python-idna-help
python-idna-doc
mingw-python-idna

Install security update from vendor's website.

idna - update to 3.15
python3-idna (Ubuntu package) - addressed in versions 3.3-1ubuntu0.2, 3.6-2ubuntu0.2, 3.11-1ubuntu0.1
python3-idna - addressed in versions 2.5-8, 3.15-1
python-idna - update to 3.6-5
python-idna-help - update to 3.6-5
python3-idna - update to 3.6-5
python-idna-doc - update to 3.15-1
python-idna - addressed in versions 3.18-1.fc43, 3.18-1.fc44
mingw-python-idna - addressed in versions 3.18-1.fc43, 3.18-1.fc44

• https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx

• Fedora 43 update for python-idna
• Fedora 44 update for python-idna
• Fedora 44 update for mingw-python-idna
• Fedora 43 update for mingw-python-idna
• openEuler update for python-idna
• Anolis OS update for python-idna
• Anolis OS update for python-idna
• Resource exhaustion in idna
• Ubuntu update for python-idna