Executive brief
The Python 'idna' library, which handles internationalized domain names, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted, extremely long domain name that causes the library to consume excessive CPU resources while processing it. This can lead to application slowdowns or complete service outages if the application does not limit the length of input domain names before processing them.
Technical details
The 'idna' library for Python (versions prior to 3.15) contains a resource exhaustion vulnerability (CWE-1333) in its handling of internationalized domain names. The root cause is the `valid_contexto` function, which processes certain Unicode payloads before performing length validation. An attacker can provide an arbitrarily large input (e.g., specific repeating Unicode characters) to the `idna.encode()` function, causing the library to spend excessive time in processing, leading to a denial-of-service. This is a regression or incomplete fix for CVE-2024-3651. The issue is mitigated in version 3.14 for primary functions and fully resolved in version 3.15 by implementing early length rejection. A manual workaround involves enforcing the standard 253-character domain name length limit before calling the library.
Affected products
- kjd idna < 3.15
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-05: disclosed: NVD publication date
- 2026-05-12: patched: Version 3.15 released to address the issue in all functions