Description
The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-validators | 0.24.0-1.2 | openSUSE-SU-2026:12046-1, openSUSE-SU-2024:13811-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | validators | >= 0.12.2, < 0.12.6 | 0.12.6 | GHSA-5qcg-w2cc-xffw |
Advisories 2
- openSUSE-SU-2026:12046-1 python313-validators-0.35.0-1.4 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- openSUSE-SU-2024:13811-1 python310-validators-0.24.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026