pypi package report

Is dnspython safe?

2 known vulnerabilities, worst severity HIGH.

// reach

10 direct dependencies

6 carry known advisories, worst CRITICAL

92 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
7.5
high

CVSS v3.1 base score out of 10

epss
0.47%
medium

chance of exploitation in 30 days, 40th percentile of all CVEs

xyz score
4.6
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-45c3-73f7-pv4m, the advisory selected below

// 2 advisories

GHSA-45c3-73f7-pv4m

HIGHGitHub ratingCVE-2026-114605
// impact

A maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required.

// patches

This problem is fixed in dnspython 2.9.0.

// workarounds

There are no known workarounds.

// credit

Evgenios Gkritsis, Department of Informatics, University of Piraeus & Athena Research Center, Greece Constantinos Patsakis, Department of Informatics, University of Piraeus & Athena Research Center, Greece George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Checked 2026-11-06 at 21:59 UTC. The most recent advisory here was published 2026-10-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.