CVE-2026-128089: Uncontrolled Resource Consumption in dnspython WKS Record Parser

Vulnerability ID: CVE-2026-128089
CVSS Score: 7.5
Published: 2026-11-13

CVE-2026-128089 is an uncontrolled resource consumption vulnerability in the dnspython toolkit for Python, affecting all versions prior to 2.9.2. When parsing Well-Known Service (WKS) records from text via dns.rdtypes.IN.WKS.WKS.from_text(), the parser fails to validate that numeric service port identifiers fall within the RFC 1035 valid range of 0 through 65535. An attacker capable of supplying untrusted zone files or RDATA text strings containing an arbitrarily large service port integer can force the parser to allocate an unbounded bitmap array using an inefficient linear append loop, resulting in severe CPU exhaustion, application hangs, or Out-Of-Memory (OOM) process termination.

TL;DR

An input validation flaw in dnspython prior to 2.9.2 allows remote attackers to trigger a Denial of Service (CPU and memory exhaustion) by supplying a WKS DNS record in text format with an arbitrarily large service port number.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-128089 (GHSA-vvf4-9x63-8xvv)
• CWE Classification: CWE-400 (Uncontrolled Resource Consumption) / CWE-770
• CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• Affected Component: dns.rdtypes.IN.WKS.WKS.from_text() in dnspython < 2.9.2
• Attack Vector: Network (Untrusted DNS zone file or RDATA text parsing)
• Primary Impact: Denial of Service via CPU exhaustion and Out-Of-Memory (OOM) crash
• Exploit Status: Proof-of-Concept (PoC) publicly documented in advisory
• CISA KEV Status: Not Listed

Affected Systems

• dnspython (PyPI package)
• dnspython: < 2.9.2 (Fixed in: 2.9.2)

Code Analysis

Commit: a62e1be

Enforce RFC 1035 bounds (0-65535) on WKS service port numbers and bitmap length (<= 8192 bytes).

diff --git a/dns/rdtypes/IN/WKS.py b/dns/rdtypes/IN/WKS.py
index ff695d9c..e6a0457c 100644
--- a/dns/rdtypes/IN/WKS.py
+++ b/dns/rdtypes/IN/WKS.py
@@ -45,6 +45,10 @@ def __init__(self, rdclass, rdtype, address, protocol, bitmap):
         self.address = self._as_ipv4_address(address)
         self.protocol = self._as_uint8(protocol)
         self.bitmap = self._as_bytes(bitmap)
+        if len(self.bitmap) > 8192:
+            raise ValueError(
+                "service bitmap must be between 0 and 8192 bytes inclusive"
+            )

     def to_styled_text(self, style: dns.rdata.RdataStyle) -> str:
         bits = []
@@ -78,11 +82,12 @@ def from_text(
                 else:
                     protocol_text = "tcp"
                 serv = socket.getservbyname(value, protocol_text)
+            if serv < 0 or serv > 65535:
+                raise ValueError("service must be between 0 and 65535 inclusive")
             i = serv // 8
             l = len(bitmap)
             if l < i + 1:
-                for _ in range(l, i + 1):
-                    bitmap.append(0)
+                bitmap.extend(bytes(i + 1 - l))
             bitmap[i] = bitmap[i] | (0x80 >> (serv % 8))
         bitmap = dns.rdata._truncate_bitmap(bitmap)
         return cls(rdclass, rdtype, address, protocol, bitmap)

Commit: 388db14

Follow-up commit for WKS bounds enforcement and unit tests in dnspython 2.9.2.

Exploit Details

• GitHub Security Advisory: Official GitHub Security Advisory containing proof-of-concept reproduction code for out-of-bounds WKS service port parsing.

Mitigation Strategies

• Upgrade dnspython to version 2.9.2 or later to enforce RFC 1035 bounds on WKS service port numbers and bitmap lengths.
• Filter or reject WKS resource records at the application ingestion layer prior to invoking dns.zone.from_text() or dns.rdata.from_text() on untrusted input.
• Enforce strict process-level memory limits (cgroups or RLIMIT_AS) and request execution timeouts on worker processes responsible for parsing user-supplied zone files.

Remediation Steps:

1. Identify all Python environments and container images utilizing dnspython versions prior to 2.9.2.
2. Update requirements.txt, pyproject.toml, or Poetry/Pipfile lockfiles to specify dnspython>=2.9.2.
3. Run pip install --upgrade 'dnspython>=2.9.2' and redeploy affected services.
4. Verify the remediation by testing that dns.rdata.from_text('IN', 'WKS', '10.0.0.1 udp 65536') raises a dns.exception.SyntaxError.

References

• CVE-2026-128089 Record on CVE.org
• NVD Entry for CVE-2026-128089
• GitHub Security Advisory GHSA-vvf4-9x63-8xvv
• GitHub Advisory Database OSV JSON for GHSA-vvf4-9x63-8xvv
• dnspython Fix Commit a62e1be066da0ed71b5b59f37435bb17cfa0070f
• dnspython Fix Commit 388db14ee9923288f6e73f86e482c77706e59d73
• dnspython v2.9.2 Release Notes
• CVEProject cvelistV5 Entry for CVE-2026-128089

Read the full report for CVE-2026-128089 on our website for more details including interactive diagrams and full exploit analysis.