{
  "schema_version": "1.4.0",
  "id": "GHSA-vvf4-9x63-8xvv",
  "modified": "2026-11-13T20:19:13Z",
  "published": "2026-11-13T20:19:13Z",
  "aliases": [
    "CVE-2026-128089"
  ],
  "summary": "dnspython has excessive memory and CPU use",
  "details": "### Summary\n\nA maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.\n\n### Details\n\nThe `from_text()` parser does not check that a WKS record service number is between 0 and 65535 inclusive.  It then uses this number to resize the bitmap to accommodate a bit with that offset.  This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.\n\n### Proof of concept\n\nThis demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.\n\n```\nrd = dns.rdata.from_text(\"IN\", \"WKS\", \"10.0.0.1 udp 65536\")\n```\n\n### Impact\n\nIf dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dnspython"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rthalley/dnspython/security/advisories/GHSA-vvf4-9x63-8xvv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rthalley/dnspython/commit/388db14ee9923288f6e73f86e482c77706e59d73"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rthalley/dnspython/commit/a62e1be066da0ed71b5b59f37435bb17cfa0070f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rthalley/dnspython"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rthalley/dnspython/releases/tag/v2.9.2"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-13T20:19:13Z",
    "nvd_published_at": null
  }
}