chore(deps): update dependency dnspython to v2.9.0 [security]

Renovate commented

2026-10-27 13:07:14 -04:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
dnspython	`2.8.0` → `2.9.0`

dnspython dns.name.from_wire_parser() excessive CPU use

CVE-2026-114605 / GHSA-45c3-73f7-pv4m

More information

Details

Impact

A maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required.

Patches

This problem is fixed in dnspython 2.9.0.

Workarounds

There are no known workarounds.

Credit

Evgenios Gkritsis, Department of Informatics, University of Piraeus & Athena Research Center, Greece
Constantinos Patsakis, Department of Informatics, University of Piraeus & Athena Research Center, Greece
George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

rthalley/dnspython (dnspython)

`v2.9.0`: dnspython 2.9.0

Compare Source

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [dnspython](https://github.com/rthalley/dnspython) | `2.8.0` → `2.9.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/dnspython/2.9.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/dnspython/2.8.0/2.9.0?slim=true) | --- ### dnspython dns.name.from_wire_parser() excessive CPU use [CVE-2026-114605](https://nvd.nist.gov/vuln/detail/CVE-2026-114605) / [GHSA-45c3-73f7-pv4m](https://github.com/advisories/GHSA-45c3-73f7-pv4m) <details> <summary>More information</summary> #### Details ##### Impact A maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required. ##### Patches This problem is fixed in dnspython 2.9.0. ##### Workarounds There are no known workarounds. ##### Credit Evgenios Gkritsis, Department of Informatics, University of Piraeus & Athena Research Center, Greece Constantinos Patsakis, Department of Informatics, University of Piraeus & Athena Research Center, Greece George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m](https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m) - [https://nvd.nist.gov/vuln/detail/CVE-2026-114605](https://nvd.nist.gov/vuln/detail/CVE-2026-114605) - [https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023](https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023) - [https://github.com/rthalley/dnspython](https://github.com/rthalley/dnspython) - [https://github.com/rthalley/dnspython/releases/tag/v2.9.0](https://github.com/rthalley/dnspython/releases/tag/v2.9.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-45c3-73f7-pv4m) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>rthalley/dnspython (dnspython)</summary> ### [`v2.9.0`](https://github.com/rthalley/dnspython/releases/tag/v2.9.0): dnspython 2.9.0 [Compare Source](https://github.com/rthalley/dnspython/compare/v2.8.0...v2.9.0) This release fixes a potential [excessive CPU consumption](https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m) issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue. See [What's New](https://dnspython.readthedocs.io/en/stable/whatsnew.html) for details. The minimum supported version of Python is 3.11. My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington. This release was published to PyPI using Trusted Publishing. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

Renovate added 1 commit

2026-10-27 13:07:14 -04:00

chore(deps): update dependency dnspython to v2.9.0 [security]

Actions / Lint (pull_request) Successful in 1m2s

Details

Actions / Build Documentation (pull_request) Successful in 56s

Details

Actions / Ensure Cogs Load (pull_request) Successful in 4m49s

Details

2c68b54b16

Renovate force-pushed renovate/pypi-dnspython-vulnerability from 2c68b54b16

Actions / Lint (pull_request) Successful in 1m2s

Details

Actions / Build Documentation (pull_request) Successful in 56s

Details

Actions / Ensure Cogs Load (pull_request) Successful in 4m49s

Details

to 2bf4f2ff17

Actions / Lint (pull_request) Successful in 58s

Details

Actions / Build Documentation (pull_request) Successful in 54s

Details

Actions / Ensure Cogs Load (pull_request) Successful in 4m28s

Details

2026-10-29 14:06:31 -04:00

Compare

Actions / Lint (pull_request) Successful in 58s

Required

Details

Actions / Build Documentation (pull_request) Successful in 54s

Required

Details

Actions / Ensure Cogs Load (pull_request) Successful in 4m28s

Required

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/pypi-dnspython-vulnerability:renovate/pypi-dnspython-vulnerability

git switch renovate/pypi-dnspython-vulnerability

Rows
Columns

chore(deps): update dependency dnspython to v2.9.0 [security] #206

dnspython dns.name.from_wire_parser() excessive CPU use

Details

Impact

Patches

Workarounds

Credit

Severity

References

Release Notes

v2.9.0: dnspython 2.9.0

Configuration

Checkout

`v2.9.0`: dnspython 2.9.0