dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4892 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4892-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/          Carlos Henrique Lima Melara     November 11, 2026                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : dnspython     Version        : 2.3.0-1+deb12u1     CVE ID         : CVE-2026-114605     Debian Bug     : 1151842

    A vulnerability was discovered in dnspython, a DNS toolkit for Python 3, which     could result in denial of service.

    For Debian 12 bookworm, this problem has been fixed in version     2.3.0-1+deb12u1.

    We recommend that you upgrade your dnspython packages.

    For the detailed security status of dnspython please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dnspython

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of dnspython installed on the remote host is prior to 2.9.0. It is, therefore, affected by a denial of service vulnerability:

  - dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS     compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer     traversal during name decompression, causing high CPU use, application degradation, or denial of service in     applications that process untrusted DNS messages. This issue is fixed in version 2.9.0. (CVE-2026-114605)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-2026_94749 advisory.

    * dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal     (CVE-2026-114605)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2258:01 advisory.

    * dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal     (CVE-2026-114605)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-94749 advisory.

    [1.15.0-13]
    - CVE-2026-114605 python-dns: dnspython: Denial of Service via excessive       DNS compression pointer traversal     Resolves: RHEL-290592

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:94749 advisory.

    * dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal     (CVE-2026-114605)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:94749 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal     (CVE-2026-114605)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-dns installed on the remote host is prior to 1.12.0-4.20150617git465785f. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4062 advisory.

    dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-     controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can     force excessive pointer traversal during name decompression, causing high CPU use, application     degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed     in version 2.9.0. (CVE-2026-114605)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3357 advisory.

    dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-     controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can     force excessive pointer traversal during name decompression, causing high CPU use, application     degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed     in version 2.9.0. (CVE-2026-114605)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-
    controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can
    force excessive pointer traversal during name decompression, causing high CPU use, application
    degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed
    in version 2.9.0. (CVE-2026-114605)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-     controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can     force excessive pointer traversal during name decompression, causing high CPU use, application     degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed     in version 2.9.0. (CVE-2026-114605)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379444	Debian dla-4892 : python3-dnspython - security update	Nessus	Debian Local Security Checks	Local	high
377044	Dnspython < 2.9.0 DoS	Nessus	Misc.	Local	high
376423	Rocky Linux 8 [CIQ] Security Update: python3-dns (crlsa-2026_94749)	Nessus	Rocky Linux Local Security Checks	Local	high
376296	MiracleLinux 8 : python-dns-1.15.0-13.el8_10 (AXSA:2026-2258:01)	Nessus	Miracle Linux Local Security Checks	Local	high
376156	Oracle Linux 8 : python-dns (ELSA-2026-94749)	Nessus	Oracle Linux Local Security Checks	Local	high
375844	RockyLinux 8 : python-dns (RLSA-2026:94749)	Nessus	Rocky Linux Local Security Checks	Local	high
375680	RHEL 8 : python-dns (RHSA-2026:94749)	Nessus	Red Hat Local Security Checks	Local	high
374382	Amazon Linux 2 : python-dns (ALAS-2026-4062)	Nessus	Amazon Linux Local Security Checks	Local	high
374369	Amazon Linux 2023 : python3-dns, python3-dns+dnssec, python3-dns+idna (ALAS2023-2026-3357)	Nessus	Amazon Linux Local Security Checks	Local	high
477725	Echo: dnspython: security update to 2.7.0-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	high
477725	Echo: dnspython: security update to 2.7.0-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
477604	SCA: security update for dnspython (GHSA-45c3-73f7-pv4m)	Tenable Cloud Security	SCA Checks	Local	high
477604	SCA: security update for dnspython (GHSA-45c3-73f7-pv4m)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
371052	Linux Distros Unpatched Vulnerability : CVE-2026-114605	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-114605

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high