Is CVE-2026-114605 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114605 being exploited in the wild.

How severe is CVE-2026-114605?

High severity, with a CVSS score of 7.5, published 22 October 2026.

Which products and versions are affected?

Dnspython before 2.9.0; dnspython (PyPI) < 2.9.0, ECOSYSTEM:introduced=0,fixed=2.9.0.

Is there a fix for CVE-2026-114605?

Yes. dnspython (PyPI): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114605 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114605?

Check whether you run Dnspython or dnspython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114605: dnspython DNS name decompression denial of service

Q: Is there a fix for CVE-2026-114605?

Yes. dnspython (PyPI): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114605 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114605?

Check whether you run Dnspython or dnspython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114605 · Severity: high · CVSS 7.5 · Published 2026-10-22

dnspython is a widely-used Python library for working with DNS queries and records. A malicious DNS message can trick the library into excessive CPU consumption during name decompression, causing applications to slow down or become unresponsive. This affects any application using dnspython to process untrusted DNS data, such as DNS servers, validators, or security tools.

Vendors: PyPI.

Quick answers

Is CVE-2026-114605 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114605 being exploited in the wild.
How severe is CVE-2026-114605?: High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?: Dnspython before 2.9.0; dnspython (PyPI) < 2.9.0, ECOSYSTEM:introduced=0,fixed=2.9.0.
Is there a fix for CVE-2026-114605?: Yes. dnspython (PyPI): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114605 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114605?: Check whether you run Dnspython or dnspython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dnspython (PyPI): upgrade to 2.9.0 or later
```
pip install "dnspython>=2.9.0"
```

Technical details

The dns.name.from_wire_parser() function follows DNS compression pointer chains without enforcing a hop limit, allowing an attacker to craft a message with circular or deeply nested pointers. A malicious DNS wire-format message forces the parser to traverse an unbounded chain of compression pointers, consuming excessive CPU during decompression. The fix limits pointer chain traversal to a maximum of 16 hops.

Affected products

dnspython dnspython before 2.9.0

Identifiers

CVE-2026-114605
GHSA-45c3-73f7-pv4m

Timeline

2026-10-22: disclosed
2026-10-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.