{"affected":[{"product":"dnspython","source":"CNA: GitHub_M","vendor":"rthalley","versions":[{"status":"affected","version":"< 2.9.0"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"dnspython","product":"dnspython","source":"OSV GHSA-45c3-73f7-pv4m","vendor":"","versions":[{"status":"affected","version":"1.0.0","versionType":"PyPI"},{"status":"affected","version":"1.1.0","versionType":"PyPI"},{"status":"affected","version":"1.10.0","versionType":"PyPI"},{"status":"affected","version":"1.11.0","versionType":"PyPI"},{"status":"affected","version":"1.11.1","versionType":"PyPI"},{"status":"affected","version":"1.12.0","versionType":"PyPI"},{"status":"affected","version":"1.13.0","versionType":"PyPI"},{"status":"affected","version":"1.14.0","versionType":"PyPI"},{"status":"affected","version":"1.15.0","versionType":"PyPI"},{"status":"affected","version":"1.16.0","versionType":"PyPI"},{"status":"affected","version":"1.2.0","versionType":"PyPI"},{"status":"affected","version":"1.3.0","versionType":"PyPI"},{"status":"affected","version":"1.3.1","versionType":"PyPI"},{"status":"affected","version":"1.3.2","versionType":"PyPI"},{"status":"affected","version":"1.3.3","versionType":"PyPI"},{"status":"affected","version":"1.3.4","versionType":"PyPI"},{"status":"affected","version":"1.3.5","versionType":"PyPI"},{"status":"affected","version":"1.4.0","versionType":"PyPI"},{"status":"affected","version":"1.5.0","versionType":"PyPI"},{"status":"affected","version":"1.6.0","versionType":"PyPI"},{"status":"affected","version":"1.7.1","versionType":"PyPI"},{"status":"affected","version":"1.8.0","versionType":"PyPI"},{"status":"affected","version":"1.9.0","versionType":"PyPI"},{"status":"affected","version":"1.9.1","versionType":"PyPI"},{"status":"affected","version":"1.9.2","versionType":"PyPI"},{"status":"affected","version":"1.9.3","versionType":"PyPI"},{"status":"affected","version":"1.9.4","versionType":"PyPI"},{"status":"affected","version":"2.0.0","versionType":"PyPI"},{"status":"affected","version":"2.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"2.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"2.1.0","versionType":"PyPI"},{"status":"affected","version":"2.1.0rc1","versionType":"PyPI"},{"status":"affected","version":"2.2.0","versionType":"PyPI"},{"status":"affected","version":"2.2.0rc1","versionType":"PyPI"},{"status":"affected","version":"2.2.1","versionType":"PyPI"},{"status":"affected","version":"2.3.0","versionType":"PyPI"},{"status":"affected","version":"2.3.0rc1","versionType":"PyPI"},{"status":"affected","version":"2.4.0","versionType":"PyPI"},{"status":"affected","version":"2.4.0rc1","versionType":"PyPI"},{"status":"affected","version":"2.4.1","versionType":"PyPI"},{"status":"affected","version":"2.4.2","versionType":"PyPI"},{"status":"affected","version":"2.5.0","versionType":"PyPI"},{"status":"affected","version":"2.5.0rc1","versionType":"PyPI"},{"status":"affected","version":"2.6.0","versionType":"PyPI"},{"status":"affected","version":"2.6.0rc1","versionType":"PyPI"},{"status":"affected","version":"2.6.1","versionType":"PyPI"},{"status":"affected","version":"2.7.0","versionType":"PyPI"},{"status":"affected","version":"2.7.0rc1","versionType":"PyPI"},{"status":"affected","version":"2.8.0","versionType":"PyPI"},{"status":"affected","version":"2.8.0rc1","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"2.9.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-114605","cwes":["CWE-674"],"description":"dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.","epss":{"date":"2026-11-10","percentile":0.40617,"score":0.00466},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794459898972,"publishedAt":1792686332509,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rthalley/dnspython/releases/tag/v2.9.0"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2026/11/msg00017.html"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-45c3-73f7-pv4m"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-45c3-73f7-pv4m"}],"remediation":[{"kind":"fix","source":"OSV GHSA-45c3-73f7-pv4m","text":"dnspython (PyPI): OSV reports a fixed version 2.9.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-45c3-73f7-pv4m"}],"revision":"aa33a1c0112eaf7f375cfae8f7adda4d8935767e27ea34a95ec91f12121ed9a7","sources":[{"modifiedAt":1794459898972,"name":"CNA: GitHub_M","retrievedAt":1794463702074,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114605"},{"modifiedAt":1793116044143,"name":"OSV / GitHub Security Advisories","retrievedAt":1794463703805,"url":"https://osv.dev/vulnerability/GHSA-45c3-73f7-pv4m"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794463724756,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114605"}],"ssvc":{"assessedAt":1793240331388,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"dnspython dns.name.from_wire_parser() excessive CPU use","updatedAt":1794463724756}