Skip to content
OpenAdvisories
Medium USN-8549-1 1 CVE

python-idna vulnerability

Published Jul 15, 2026 · Updated Jul 15, 2026

Ecosystem: Ubuntu

Summary

It was discovered that idna did not properly reject oversized inputs before
performing expensive processing. An attacker could possibly use this issue
to cause idna to consume significant resources, leading to a denial of
service.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-idna 3.3-1ubuntu0.2
Ubuntu · 24.04 LTS 24.04:LTS python-idna 3.6-2ubuntu0.2
Ubuntu · 26.04 LTS 26.04:LTS python-idna 3.11-1ubuntu0.1

Vulnerabilities 1

  • Medium 6.9
    CVE-2026-45409

    Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

    Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N …

    kjd idna open-webui katib-suggestion-hyperopt Debian Ubuntu Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2026-45409