Excessive Memory Consumption Vulnerability in dnspython by Python Software Foundation

CVE-2026-128089

What is CVE-2026-128089?

The dnspython toolkit for Python is vulnerable due to a flaw in the from_text() parser for WKS records, which does not validate service numbers. An attacker could exploit this bug by providing a zone file that causes the service bitmap to expand disproportionately, leading to excessive memory and CPU usage. If this issue is not addressed, it may result in denial of service for applications that parse attacker-controlled zone-file text. The vulnerability is remedied in dnspython version 2.9.2.

References