Skip to content
Fencer Intel
medium 5.3

CVE-2026-45409 json

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

published 5mo ago modified last mo. also GHSA-65pc-fj4g-8rjx , PYSEC-2026-215 , EUVD-2026-34921

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.

Patch / fix

  • pypi idna 3.15
  • kjd internationalized_domain_names_in_applications 3.15
  • python-idna Debian 13 3.10-1+deb13u1
  • python-idna Debian 14 3.11-1.1

debian advisories DEBIAN-CVE-2026-45409

  • python-idna Ubuntu 22.04 LTS 3.3-1ubuntu0.2
  • python-idna Ubuntu 24.04 LTS 3.6-2ubuntu0.2
  • python-idna Ubuntu 26.04 LTS 3.11-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-45409

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-idna RHEL 9 2.10-8.el9_8
  • python3-idna RHEL 9 2.10-8.el9_8
  • python-idna RHEL 10.2 3.7-6.el10_2
  • python3-idna RHEL 10.2 3.7-6.el10_2
  • python-idna RHEL 8 2.5-8.el8_10
  • python3-idna RHEL 8 2.5-8.el8_10
  • python-rpds-py hummingbird 1 2026.6.3-1.hum1
  • python3-rpds-py hummingbird 1 2026.6.3-1.hum1

red hat advisories RHSA-2026:54484RHSA-2026:54481RHSA-2026:54290RHSA-2026:34119RHSA-2026:25503RHSA-2026:25039

  • grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
  • mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1
  • spacecmd Multi Linux Manager Tools SLE-15 5.2.10-150002.3.15.1
  • uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.2.17-150002.3.20.1
  • venv-salt-minion Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 3006.0-150002.5.22.1
  • spacewalk-client-tools Multi Linux Manager Tools SLE-15 5.2.7-150002.3.12.1
  • golang-github-prometheus-prometheus Multi Linux Manager Tools SLE-15 3.13.2-150002.3.19.1
  • mgr-push Multi Linux Manager Tools SLE-12 5.2.5-120002.3.12.1

suse advisories SUSE-SU-2026:4585-1SUSE-SU-2026:4584-1SUSE-SU-2026:4583-1SUSE-SU-2026:4582-1SUSE-SU-2026:4581-1SUSE-SU-2026:4580-1

  • python-idna openSUSE Leap 16.0 3.10-160000.3.1
  • python-idna openSUSE Tumbleweed 3.15-1.1

opensuse advisories openSUSE-SU-2026:21048-1openSUSE-SU-2026:10829-1

  • python3-idna AlmaLinux 10 3.7-6.el10_2
  • python3-idna AlmaLinux 9 2.10-8.el9_8
  • python3-idna AlmaLinux 8 2.5-8.el8_10

almalinux advisories ALSA-2026:54481ALSA-2026:54484ALSA-2026:54290

  • python-idna Rocky Linux 10 3.7-6.el10_2
  • python-idna Rocky Linux 9 2.10-8.el9_8
  • python-idna Rocky Linux 8 2.5-8.el8_10

rocky linux advisories RLSA-2026:54481RLSA-2026:54484RLSA-2026:54290

Is CVE-2026-45409 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45409 updated cvss 5.3

python-idna: idna: Denial of Service via specially crafted long inputs

  • Red Hat Confidential Cluster Operator confidential-clusters-beta/compute-pcrs-rhel9, confidential-clusters-beta/registration-server-rhel9, confidential-clusters-beta/attestation-key-register-rhel9, confidential-clusters-beta/confidential-cluster-rhel9-operator, confidential-clusters-beta/confidential-cluster-operator-bundle Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/bitwarden-sdk-server-rhel9, external-secrets-operator/external-secrets-operator-rhel9, external-secrets-operator/external-secrets-operator-bundle Red Hat Migration Toolkit for Applications 8 mta/mta-rhel9-operator, mta/mta-solution-server-rhel9, mta/mta-dotnet-external-provider-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-rhel8-operator Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-rhel9-operator
    +22 more products
    Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed/lightspeed-agentic-sandbox-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9, openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9, rhacm2/volsync-operator-bundle Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9, +4 more Red Hat Ansible Automation Platform 2 python-idna 3.7-1.el9ap, automation-controller 4.7.13-2.el9ap, ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-27/hub-rhel9, ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-27/gateway-rhel9, +44 more Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9 Red Hat build of Quarkus Native builder idna 2.5 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/rhdh-must-gather-rhel9 Red Hat Enterprise Linux 7 python-idna, python-idna 3.7-1.el9ap Red Hat Enterprise Linux 8 fence-agents, ubi8/toolbox, fence-agents-all, fence-agents-apc, fence-agents-aws, fence-agents-eps, +47 more Red Hat Enterprise Linux 9 ubi9, fence-virt, fence-virtd, python3-pip, fence-agents, ubi9/toolbox, +69 more Red Hat Enterprise Linux 10 ubi10, ubi10/toolbox, rhel10-2-els/rhel, rhel10/rhel-bootc, rhel10/keylime-verifier, rhel10/keylime-registrar, +4 more Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/rhai-cli-rhel9, rhoai/odh-automl-rhel9, rhoai/odh-mlflow-rhel9, rhoai/odh-autorag-rhel9, rhoai/odh-mlserver-rhel9, rhoai/odh-vllm-gaudi-rhel9, +53 more Red Hat OpenShift Container Platform 4 python-idna 3.7-1.el9ap, openshift/ose-rhel-coreos-9, openshift4/ose-olm-catalogd-rhel9, openshift4/ose-ansible-rhel9-operator Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9, openshift5/ose-ansible-rhel9-operator Red Hat OpenShift Virtualization 4 container-native-virtualization/ocp-virt-validation-checkup-rhel9 Red Hat Satellite 6 python3-idna, python-idna 3.7-1.el9ap, satellite/iop-vmaas-rhel9, satellite/iop-puptoo-rhel9, satellite/iop-yuptoo-rhel9, satellite/iop-advisor-engine-rhel9, +4 more Red Hat Trusted Artifact Signer rhtas/segment-reporting-rhel9, rhtas/model-transparency-rhel9 Red Hat Update Infrastructure 4 for Cloud Providers python-idna 3.7-1.el9ap Red Hat Self-service automation portal 2 ansible-automation-platform/bootc-automation-portal-rhel9 Red Hat Service Telemetry Framework 1.5 stf/smart-gateway-rhel9-operator, stf/service-telemetry-rhel9-operator
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1788206196
    fixed: vendor fix RHSA-2026:61783
  • Red Hat Enterprise Linux BaseOS (v. 8) python-idna 2.5-8.el8_10, python3-idna 2.5-8.el8_10
    fixed: vendor fix RHSA-2026:54290
  • Red Hat Enterprise Linux BaseOS (v. 9) python-idna 2.10-8.el9_8, python3-idna 2.10-8.el9_8
    fixed: vendor fix RHSA-2026:54484
  • Red Hat Enterprise Linux BaseOS (v. 10) python-idna 3.7-6.el10_2, python3-idna 3.7-6.el10_2
    fixed: vendor fix RHSA-2026:54481
  • Red Hat Hardened Images jaeger 2.19.0-1.hum1, python-idna 3.18-1.hum1, python3-idna 3.18-1.hum1, python-rpds-py 2026.6.3-1.hum1, python3-rpds-py 2026.6.3-1.hum1
    fixed: vendor fix RHSA-2026:25039
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1788880464, rhui5/rhua-rhel9 1788880581, rhui5/haproxy-rhel9 1788880456, rhui5/rhua-tp-rhel9 1787241260, rhui5/installer-rhel9 1788765051, rhui5/installer-tp-rhel9 1787135742, +2 more
    fixed: vendor fix RHSA-2026:66018
show 1 more
  • Red Hat Confidential Cluster Operator confidential-clusters-beta/buildroot-rhel9 Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9, openshift-sandboxed-containers/osc-podvm-payload-rhel9 Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9
    not affected: vulnerable code not present

18 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
pypi idna
<3.15
3.15

Affected products

  • kjd idna

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.