CVE-2022-45061

Name of the Vulnerable Software and Affected Versions Python versions prior to 3.11.1 Python versions prior to 3.10.9 Python versions prior to 3.9.16 Python versions prior to 3.8.16 Python versions prior to 3.7.16

Description An issue exists in the IDNA (RFC 3490) decoder, where an unnecessary quadratic algorithm can lead to a CPU denial of service when processing crafted, unreasonably long names. This could be triggered by a malicious actor supplying a hostname that causes excessive CPU consumption on the client. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302.

Recommendations For versions prior to 3.11.1, update to version 3.11.1 or later. For versions prior to 3.10.9, update to version 3.10.9 or later. For versions prior to 3.9.16, update to version 3.9.16 or later. For versions prior to 3.8.16, update to version 3.8.16 or later. For versions prior to 3.7.16, update to version 3.7.16 or later.