Skip to content

Product

debian/dnspython vulnerabilities

3 published CVES affecting debian/dnspython, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
2
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest debian/dnspython CVEs

Newest publication first

  1. CVE-2026-114605 dnspython dns.name.from_wire_parser() excessive CPU use

    Published
    HighCVSS 7.5 EPSS 0.47%

    dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU u...

  2. CVE-2023-29483 Potential DoS via the Tudoor mechanism in eventlet and dnspython

    Published
    HighCVSS 7.0 EPSS 1.9%

    eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred...

  3. CVE-2008-1447 The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementati...

    Published
    MediumCVSS 6.8 EPSS 95.2% Framework module Public exploit

    The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.