CVE-2026-45409 kjd CVE debrief

Who should care

Developers and administrators using Internationalized Domain Names in Applications (IDNA) for Python, especially those who handle domain names that may be passed to the `idna.encode()` function without proper validation.

Technical summary

The `idna.encode()` function in versions of IDNA for Python prior to 3.15 does not efficiently handle long inputs. Payloads such as a large number of Unicode characters can cause the function to consume significant resources, leading to a denial-of-service. This is due to the function's processing of inputs before rejecting them based on length. Starting with version 3.14, the function was modified to reject long inputs sooner to minimize resource consumption. Version 3.15 extended this approach to other functions.

Defensive priority

MEDIUM

Recommended defensive actions

• Update to version 3.15 or later of Internationalized Domain Names in Applications (IDNA) for Python.
• Enforce a domain name length limit of 253 characters before passing the domain to the `idna.encode()` function.

Evidence notes

The vulnerability is documented in the official CVE record [cve-org] and detailed in the NVD [nvd]. A security advisory is available [ref-4].

Official resources