# CVE-2026-114605: dnspython DNS name decompression denial of service

Source: https://junglewise.ai/threats/cve-2026-114605-dnspython-is-a-dns-toolkit-for-python-prior-to-2-9-0-dns-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114605 · Severity: high · CVSS 7.5 · Published 2026-10-22

dnspython is a widely-used Python library for working with DNS queries and records. A malicious DNS message can trick the library into excessive CPU consumption during name decompression, causing applications to slow down or become unresponsive. This affects any application using dnspython to process untrusted DNS data, such as DNS servers, validators, or security tools.

Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-114605 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114605 being exploited in the wild.

**How severe is CVE-2026-114605?** High severity, with a CVSS score of 7.5, published 22 October 2026.

**Which products and versions are affected?** Dnspython before 2.9.0; dnspython (PyPI) < 2.9.0, ECOSYSTEM:introduced=0,fixed=2.9.0.

**Is there a fix for CVE-2026-114605?** Yes. dnspython (PyPI): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114605 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114605?** Check whether you run Dnspython or dnspython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dnspython (PyPI): upgrade to 2.9.0 or later

  ```sh
  pip install "dnspython>=2.9.0"
  ```


## Technical details

The dns.name.from_wire_parser() function follows DNS compression pointer chains without enforcing a hop limit, allowing an attacker to craft a message with circular or deeply nested pointers. A malicious DNS wire-format message forces the parser to traverse an unbounded chain of compression pointers, consuming excessive CPU during decompression. The fix limits pointer chain traversal to a maximum of 16 hops.

## Affected products

- dnspython dnspython before 2.9.0

## Identifiers

- CVE-2026-114605
- GHSA-45c3-73f7-pv4m

## Timeline

- 2026-10-22: disclosed
- 2026-10-09: patched

## References

- [https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023](https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023)
- [https://github.com/rthalley/dnspython/releases/tag/v2.9.0](https://github.com/rthalley/dnspython/releases/tag/v2.9.0)

## Related threats

- [PYSEC-2026-2472 - Potential DoS via the Tudoor mechanism in eventlet and dnspython](https://junglewise.ai/threats/cve-2023-29483-potential-dos-via-the-tudoor-mechanism-in-eventlet-and-dnspython)