chore(deps): update dependency idna to v3.15 [security] #82
finkregh
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/pypi-idna-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
3.11→3.15Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
CVE-2026-45409 / GHSA-65pc-fj4g-8rjx / PYSEC-2026-215
More information
Details
This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as
"\u0660" * Nor"\u30fb" * N + "\u6f22"utilize thevalid_contextofunction prior to length rejection, and for high values ofNwill take a long time to process.Impact
A specially crafted argument to the
idna.encode()function could consume significant resources. This may lead to a denial-of-service.Patches
Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).
Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the
idna.encode()function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
CVE-2026-45409 / GHSA-65pc-fj4g-8rjx / PYSEC-2026-215
More information
Details
Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as
"\u0660" * Nor"\u30fb" * N + "\u6f22"utilize thevalid_contextofunction prior to length rejection, and for high values ofNwill take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to theidna.encode()function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to theidna.encode()function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).
Release Notes
kjd/idna (idna)
v3.15Compare Source
check_label,short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared
_unicode_dots_refromidna.corein the codec module.raise ... from errfor proper exception chaining andswitch internal string formatting to f-strings.
flit_core4.x in the build backend.pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.
initial GHSA identifier.
Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.
v3.14Compare Source
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]
Thanks to Stan Ulbrych for reporting the issue.
v3.13Compare Source
v3.12Compare Source
segmentation of data structures specific to Jython.
Thanks to Rodrigo Nogueira for contributions to this release.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.