CVE-2026-45409: Denial-of-Service in Python IDNA Library via Resource Exhaustion

Technical summary

CVE-2026-45409 is a denial-of-service vulnerability in the kjd/idna Python library caused by algorithmic inefficiency in the valid_contexto validation function. Payloads such as repeated Unicode characters (e.g., '\u0660' repeated N times or '\u30fb' repeated N times followed by '\u6f22') trigger expensive processing even before length validation rejects them. The CVSS 3.1 score of 5.3 reflects network-accessible attack surface with no authentication required and low impact (availability only). The vulnerability affects versions prior to 3.14 (which added early length rejection) and persists in alternate code paths until version 3.15. The issue is classified under CWE-1333 (Inefficient Regular Expression Complexity), though the root cause is pre-length validation resource consumption rather than regex backtracking per se. Workaround: enforce a 253-character length limit at the application layer before calling idna.encode().

Business impact

Organizations using the Python IDNA library in internet-facing applications without upstream input validation may experience service degradation if an attacker sends specially crafted domain names. The impact is limited to availability; no data confidentiality or integrity is compromised. Libraries that depend on idna (DNS resolvers, email validators, web frameworks) are potential vectors. Most affected will be services that accept arbitrary domain input—such as DNS query tools, domain registration validators, or email address processors—without length validation. The MEDIUM severity and low CVSS score reflect that this requires attacker control over domain input and that the impact is denial-of-service rather than code execution or data exposure. However, in multi-tenant or public-facing SaaS scenarios, attackers could degrade service for other users.

Affected systems

The vulnerability affects Python applications using the kjd internationalized_domain_names_in_applications (idna) library in versions prior to 3.14 for the primary attack surface, and prior to 3.15 for complete remediation across all function variants (per-label conversions and codec support). Any service or library that accepts domain names or email addresses and passes them to idna.encode() without preliminary length validation is at risk. This includes DNS clients, email validators, domain whitelisting tools, and any web framework or middleware that processes domain inputs. Applications running version 3.15 or later are not vulnerable. Versions 3.14 and later have partial mitigation; verify whether your dependency chain uses only the primary encode() path or also calls the alternate functions (codec or per-label APIs).

Exploitability

Exploitability is straightforward: an attacker needs only network access to submit a specially crafted domain name to a vulnerable endpoint. No authentication, user interaction, or privileges are required. The attack is deterministic—specific Unicode sequences repeated to large scale will reliably trigger resource exhaustion. However, real-world exploitability is constrained by the fact that normal domain usage never involves such inputs. An attacker must either control the domain name input directly (e.g., via a web form, API parameter, or DNS query) or manipulate another user's input. The vulnerability is not in the CISA KEV catalog, indicating no active in-the-wild exploitation has been reported to date. The attack surface depends on application design: if the application enforces a 253-character limit or validates input before passing to idna, exploitability is eliminated.

Remediation

Upgrade the kjd/idna library to version 3.15 or later. This extends early input rejection to all code paths. For version 3.14, the fix is incomplete and applies only to the primary encode() function; if your application uses per-label functions or codec interfaces, upgrade to 3.15. If immediate upgrade is not feasible, implement a length check at the application layer: reject any domain input exceeding 253 characters before it reaches the idna library. This workaround is standards-compliant (DNS limits domains to 253 characters) and eliminates the vulnerability in practice. Verify dependencies: review all packages that import idna to ensure they are compatible with the upgraded version and that no pinned sub-dependencies force the use of older versions.

Patch guidance

Update idna to version 3.15 or later. Consult the kjd/idna GitHub repository and PyPI package page for the latest release notes and compatibility information. The fix involves rejecting arbitrarily long inputs early in the validation pipeline, before expensive Unicode processing occurs. When upgrading, test DNS resolution, email validation, and any domain-processing workflows to ensure compatibility. If your application uses custom IDNA functions or has integrated idna into a proprietary codebase, verify that the upgrade does not break any assumptions about error handling or validation timing. Minor version upgrades should be safe; pin to 3.15 or a later patch release (3.15.x) to receive security updates without major version bumps.

Detection guidance

Monitor application logs and metrics for sudden spikes in CPU usage or process hang events correlated with domain name input. Watch for repeated submission of very long domain names or suspicious Unicode character sequences in DNS queries, email headers, or domain input fields. Network-based detection is challenging without deep packet inspection, since the attack appears as a normal domain name query or API request; focus on application-layer signals. If you maintain DNS logs, look for queries containing Unicode escapes or sequences that are unusually long. Review dependency trees to identify which services import idna and audit their input validation. Test your applications by submitting a crafted payload (e.g., a domain name 10,000+ characters long containing repeated \u0660 sequences) to a non-production environment and observe resource consumption.

Why prioritize this

Prioritize patching based on exposure: services that accept user-supplied domain names or email addresses without length validation should upgrade immediately. Applications with IDNA libraries pinned to versions prior to 3.14 should be treated as higher priority. However, given the CVSS score of 5.3 (MEDIUM), the lack of KEV listing, and the requirement for either attacker-controlled input or no upstream validation, this is not a critical emergency. Balance this against your patch cycle: if your organization has a regular monthly or quarterly patching process, CVE-2026-45409 should be included in the next release cycle. High-risk exceptions: public DNS services, email validation APIs, and domain registration tools should prioritize faster patching.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects the following factors: Network-accessible (AV:N), no authentication required (PR:N), low attack complexity (AC:L), no user interaction needed (UI:N), and impact limited to availability (A:L with C:N and I:N). The score is not elevated to HIGH because the attack surface is narrow (requires unvalidated input) and the impact is denial-of-service rather than privilege escalation or data breach. The vulnerability is real and exploitable under the right conditions, but the bar for triggering it is higher than a typical network-based RCE. In an organization without strict input validation, the risk is closer to the upper end of MEDIUM; in organizations with robust input sanitization, the risk is lower.

Frequently asked questions