CVE-2026-114605

Name of the Vulnerable Software and Affected Versions dnspython versions prior to 2.9.0

Description The dns.name.from wire parser function fails to implement a hop limit when following DNS compression pointer chains. An attacker can send a specially crafted DNS wire-format message that triggers excessive pointer traversal during name decompression. This can lead to high CPU utilization, application degradation, or a denial of service for applications processing untrusted DNS messages.

Recommendations Update to version 2.9.0.