dnspython CVE-2026-128089: upgrade to version 2.9.2 or later

GitHub Advisories published alert GHSA-vvf4-9x63-8xvv for the DNS library dnspython. The vulnerability may occur when parsing a malicious zone file; the stated remediation is to upgrade to version 2.9.2 or later. View the GitHub advisory.

Overview and technical details

dnspython is a Python library for working with DNS. CVE-2026-128089 is assigned CWE-400 and CWE-770, with a CVSS score of 7.5 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected systems

The risk is particularly relevant if an application reads zone files containing data controlled by users or an untrusted source.

Mechanism and impact

The from_text() parsing function does not check whether the number of services in a WKS record is within the range 0–65535 before using that value to expand a bitmap. An attacker-controlled zone file can cause the library to allocate a very large amount of memory and consume CPU.

Possible consequences are denial of service or process termination due to memory exhaustion.

System checks

1. Check the dnspython version installed in the current Python environment:

   Copy commands

   python -m pip show dnspython

   Version 2.9.2 or later is fixed; versions below 2.9.2 need to be upgraded.

Remediation and mitigation

1. Upgrade the pip:dnspython package to version 2.9.2 or later, especially if the application reads zone files containing data controlled by users or an untrusted source.

2. After upgrading, run python -m pip show dnspython again and confirm the version is 2.9.2 or later.

References

• GitHub Advisories: GHSA-vvf4-9x63-8xvv