dnspython vulnerabilities

2 known vulnerabilities in dnspython from Rthalley. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  dnspython: Uncontrolled Resource Consumption

  CVE-2026-128089Nov 13, 2026Rthalley

  dnspython is a DNS toolkit for Python. Prior to version 2.9.2, the from_text() parser for WKS records does not require the service number to be between 0 and 65535 before using it as a bitmap offset. An attacker-controlled zone file can supply a larger number,

• 7.5 High severity

  dnspython: Uncontrolled Recursion

  CVE-2026-114605Oct 22, 2026Rthalley

  dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression