Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8549-1 advisory.

    It was discovered that idna did not properly reject oversized inputs before performing expensive     processing. An attacker could possibly use this issue to cause idna to consume significant resources,     leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-822c07add4 advisory.

    Update to the latest version to bring fixes for CVE-2026-45409 and CVE-2024-3651 into the stable releases.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2828-1 advisory.

    This update for python-idna fixes the following issue

    - CVE-2026-45409: specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized     Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15,     payloads such as `\u0660 * N` or `\u30fb * N + \u6f22` utilize the `valid_contexto` function prior     to length rejection, and for high values of `N` will take a long time to process. This is the same issue     as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted     argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-     of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any     further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser     used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain     names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain     to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by     arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming     there is no preliminary input validation by the higher-level application. (CVE-2026-45409)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized
    Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15,
    payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior
    to length rejection, and for high values of `N` will take a long time to process. This is the same issue
    as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted
    argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-
    of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any
    further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser
    used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain
    names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain
    to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by
    arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming
    there is no preliminary input validation by the higher-level application. (CVE-2026-45409)

ID	Name	Product	Family	Severity
327339	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : idna vulnerability (USN-8549-1)	Nessus	Ubuntu Local Security Checks	medium
326408	Fedora 44 : python-idna (2026-822c07add4)	Nessus	Fedora Local Security Checks	medium
326331	SUSE SLED15 / SLES15 Security Update : python-idna (SUSE-SU-2026:2828-1)	Nessus	SuSE Local Security Checks	medium
319607	Linux Distros Unpatched Vulnerability : CVE-2026-45409	Nessus	Misc.	medium
442175	SCA: security update for idna (GHSA-65pc-fj4g-8rjx)	Tenable Cloud Security	SCA Checks	medium
442175	SCA: security update for idna (GHSA-65pc-fj4g-8rjx)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-45409

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium