CVE-2026-45409

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significant resources, leading to a Denial of Service (DoS), where the affected application becomes unavailable to legitimate users. This issue stems from an incomplete fix for a previously identified vulnerability.

A flaw was found in the python-idna library. This is an incomplete fix for CVE-2024-3651. The idna.encode() function performs contextual validation checks (valid_contexto) before rejecting oversized inputs, allowing specially crafted long payloads to cause excessive CPU consumption and lead to a denial of service. The fix in version 3.14 rejects long inputs early before further processing, and version 3.15 extends this approach to alternate per-label conversion and codec functions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this denial-of-service vulnerability, applications utilizing the idna Python library should implement input validation to ensure that domain names do not exceed the standard 253-character length limit before being passed to the idna.encode() function. This operational control prevents the processing of excessively long inputs that could lead to resource exhaustion and service unavailability.

Applications that pass user-controlled data directly to idna.encode() without validation checks (e.g.: DNS length < 254 chars) are affected.