Denial-of-Service Vulnerability in Internationalized Domain Names for Python

CVE-2026-45409

What is CVE-2026-45409?

The Internationalized Domain Names in Applications (IDNA) for Python prior to version 3.15 is susceptible to a resource exhaustion vulnerability. The idna.encode() function does not properly validate input length, allowing specially crafted arguments to consume excessive processing resources. This can result in denial-of-service conditions if high values are submitted, particularly in payloads that bypass preliminary length checks. Although mitigation was partially implemented in prior versions, subsequent updates have improved input validation, rejecting long inputs early in the processing cycle. A workaround is available by enforcing a maximum domain name length of 253 characters, which prevents significant resource consumption from malicious inputs.

References