https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 04:20:51 +0000 https://db.gcve.eu/vuln/ghsa-vvf4-9x63-8xvv <p><strong>Affected:</strong> PyPI: dnspython</p> <p>### Summary</p> <p>A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.</p> <p>### Details</p> <p>The `from_text()` parser does not check that a WKS record service number is between 0 and 65535 inclusive. It then uses this number to resize the bitmap to accommodate a bit with that offset. This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.</p> <p>### Proof of concept</p> <p>This demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.</p> <p>``` rd = dns.rdata.from_text(&#34;IN&#34;, &#34;WKS&#34;, &#34;10.0.0.1 udp 65536&#34;) ```</p> <p>### Impact</p> <p>If dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.</p> <p><strong>Affected:</strong> PyPI: dnspython</p> <p>### Summary</p> <p>A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.</p> <p>### Details</p> <p>The `from_text()` parser does not check that a WKS record service number is between 0 and 65535 inclusive. It then uses this number to resize the bitmap to accommodate a bit with that offset. This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.</p> <p>### Proof of concept</p> <p>This demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.</p> <p>``` rd = dns.rdata.from_text(&#34;IN&#34;, &#34;WKS&#34;, &#34;10.0.0.1 udp 65536&#34;) ```</p> <p>### Impact</p> <p>If dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.</p> https://db.gcve.eu/vuln/ghsa-vvf4-9x63-8xvv