Denial of Service Issue in Python's IDNA Decoder

CVE-2022-45061

What is CVE-2022-45061?

A vulnerability has been discovered in Python related to its IDNA decoder, where an inefficient quadratic algorithm can be exploited. When overly long hostnames are processed, typically provided by remote servers that may be controlled by malicious actors, the vulnerability can cause excessive CPU utilization. This issue can be leveraged by an attacker by embedding a crafted hostname in the Location header of an HTTP response with a 302 status code. The impact can lead to a denial of service for legitimate users, as their systems may experience significant performance degradation. Affected versions have fixes planned for release in subsequent updates.

References