Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode
RSS Feed
MODERATE
GHSA-jjg7-2v4v-x38h
CVE-2024-3651
Description:
Impact
A specially crafted argument to the idna.encode() function could consume significant resources. This may lead to a denial-of-service.
Patches
The function has been refined to reject such strings without the associated resource consumption in version 3.7.
Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the idna.encode() function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
References
Affected Packages
| Ecosystem | Package | Vulnerable Versions | Patched Version |
|---|---|---|---|
| pypi |
idna
|
< 3.7 |
3.7
|
build(deps): bump the uv group across 1 directory with 7 updates
Closed 1 day ago
dongtan-91-dong-welfare-center/rag_for_accounting #391
pip:pydantic-settings
pip:idna
+5 more
chore(deps): bump idna from 3.11 to 3.15 in /docker
Closed 3 days ago
manjunathshiva/opendecider #21
pip:idna
Bump the uv group across 1 directory with 9 updates
Closed 4 days ago
fclinton/pi-couch-hound #125
pip:python-multipart
pip:urllib3
+7 more
Bump the pip group across 1 directory with 7 updates
Open 10 days ago
timerloggedout-spec/hermes-agent_fork #5
pip:aiohttp
pip:urllib3
+5 more
chore(deps): bump idna from 3.13 to 3.15
Closed 10 days ago
runnithan/claudex-setup #1
pip:idna
Bump idna from 3.10 to 3.15
Closed 15 days ago
Airbus-A330/OSPSD-Team-2 #5
pip:idna
Bump the uv group across 1 directory with 10 updates
Closed 16 days ago
yonatangross/easyvibe #2
pip:python-multipart
pip:urllib3
+8 more
Bump the pip group across 1 directory with 2 updates
Open 16 days ago
timerloggedout-spec/paddler_fork #3
pip:idna
pip:anyio
chore(deps): bump the pip group across 1 directory with 17 updates
Open 17 days ago
alphaleadership/sentry #2
pip:setuptools
pip:django
+15 more
chore(deps): bump the pip group across 1 directory with 12 updates
Open 17 days ago
rajivranjanmars/microservices-demo #1
pip:aiohttp
pip:werkzeug
+10 more
chore(deps): bump idna from 3.13 to 3.15 in /ops-agent
Open 17 days ago
UlloaSP/mlsuite #18
pip:idna
Bump the uv group across 1 directory with 6 updates
Open 19 days ago
christophernemala/o2c-orchestration-platform #1
pip:setuptools
pip:urllib3
+4 more
Bump the pip group across 1 directory with 6 updates
Open 20 days ago
black-da-bull/llm-workflow-engine #1
pip:jinja2
pip:certifi
+4 more
chore(deps): bump the uv group across 1 directory with 5 updates
Open 22 days ago
rubicon/mempalace #29
pip:setuptools
pip:cryptography
+3 more
chore(deps): bump the pip group across 1 directory with 2 updates
Open 22 days ago
Emadalshamery/bsc-genesis-contract #4
pip:idna
pip:web3
Bump the pip group across 1 directory with 7 updates
Closed 22 days ago
FalkorDB/graph-exporter #33
pip:pytest
pip:cryptography
+3 more
build(deps): Bump the uv group across 1 directory with 6 updates
Open 22 days ago
FalkorDB/Mem0-Demo #7
pip:urllib3
pip:pytest
+4 more
chore(deps): bump the uv group across 1 directory with 2 updates
Closed 23 days ago
doublegate/OctoLLM #31
pip:idna
pip:pygments
Bump the uv group across 1 directory with 13 updates
Closed 24 days ago
c1490b-code/soda-ftp-download #1
pip:h11
pip:tornado
+10 more
build(deps): bump the pip group across 2 directories with 4 updates
Closed 25 days ago
openlawlibrary/pygls #626
pip:urllib3
pip:requests
+2 more
chore(deps): bump idna from 3.11 to 3.15 in /search
Closed 28 days ago
twangodev/uwcourses #1415
pip:idna
Bump the pip group across 1 directory with 11 updates
Closed 28 days ago
dlove24/lbutils #83
pip:jinja2
pip:black
+9 more
Bump the uv group across 1 directory with 15 updates
Closed 28 days ago
theobredemann/solar-plant-problem-detection #1
pip:werkzeug
pip:tornado
+12 more
Bump the pip group across 1 directory with 11 updates
Open 29 days ago
WebCraftPhil/firecrawl-app-examples #1
pip:h11
pip:protobuf
+9 more
Bump the uv group across 1 directory with 9 updates
Open 29 days ago
WebCraftPhil/Voice-Agent-Livekit-Python #5
pip:aiohttp
pip:protobuf
+7 more
build(deps): bump the uv group across 1 directory with 7 updates
Open 30 days ago
00o-sh/openpilot #4
pip:setuptools
pip:aiohttp
+5 more
chore(deps): bump the uv group across 2 directories with 11 updates
Open 30 days ago
MTG-Thomas/bifrost-docs #71
pip:aiohttp
pip:python-multipart
+9 more
build(deps): bump idna from 3.6 to 3.15 in /scripts/conformance/ogcapi
Open 30 days ago
honua-io/honua-server #4305
pip:idna
Bump the pip group across 1 directory with 7 updates
Open about 1 month ago
snowmy-tech/cookbook #1
pip:uv
pip:lxml
+5 more
Bump the pip group across 1 directory with 5 updates
Closed about 1 month ago
EchoCog/skintwin #32
pip:urllib3
pip:requests
+3 more
Bump idna from 3.11 to 3.15
Closed about 1 month ago
GuyErreich/Action-Semver-Control #267
pip:idna
chore(deps): bump the uv group across 1 directory with 11 updates
Closed about 1 month ago
2233admin/codenexus #20
pip:setuptools
pip:aiohttp
+5 more
chore(deps): bump the pip group across 1 directory with 13 updates
Open about 1 month ago
Into-The-Grey/Auton-OSINT #45
pip:setuptools
pip:aiohttp
+11 more
chore(deps): bump the uv group across 13 directories with 12 updates
Open about 1 month ago
aws/deep-learning-containers #6690
pip:idna
pip:pip
+4 more
chore(deps): bump the uv group across 13 directories with 12 updates
Open about 1 month ago
aws/deep-learning-containers #6689
pip:idna
pip:pip
+4 more
build(deps): bump the pip group across 4 directories with 6 updates
Open about 1 month ago
kubernetes-sigs/agent-sandbox #1516
pip:python-multipart
pip:pillow
+4 more
build(deps): bump the pip group across 4 directories with 6 updates
Closed about 1 month ago
kubernetes-sigs/agent-sandbox #1495
pip:pillow
pip:idna
+2 more
Bump idna from 3.10 to 3.15
Closed about 1 month ago
opper-ai/opper-web-indexer-action #9
pip:idna
Bump idna from 3.4 to 3.15
Open about 1 month ago
btclib-org/btclib_node #23
pip:idna
chore(deps): bump the pip group across 1 directory with 11 updates
Closed about 2 months ago
dsocial118/SISOC #2324
pip:lxml
pip:black
+9 more
chore(deps): bump the uv group across 1 directory with 13 updates
Closed about 2 months ago
klemensgraf/sports-analytics #46
pip:setuptools
pip:urllib3
+10 more
chore(deps): bump the uv group across 1 directory with 16 updates
Closed about 2 months ago
thruthseeker/Tics-openai-agents-python #4
pip:aiohttp
pip:litellm
+14 more
Bump idna from 3.10 to 3.15
Closed about 2 months ago
PcnaidInc/androidbuild-mcp #3
pip:idna
Bump idna from 3.11 to 3.15 in /webapp/worker
Closed about 2 months ago
TKlerx/click-tt-auto #45
pip:idna
Bump idna from 3.10 to 3.15 in /infrastructure/software-engineering/language/python/dependency-management/uv
Closed about 2 months ago
andreyolv/pikakube #11
pip:idna
build(deps): bump the uv group across 1 directory with 14 updates
Closed about 2 months ago
CraftTool/multi-agent-dd-pipeline #1
pip:lxml
pip:langchain-openai
+11 more
Bump the uv group across 1 directory with 16 updates
Closed 2 months ago
HuffmanMainNode/ARC-AGI-3-Agents-ForkByMrCakes931 #1
pip:aiohttp
pip:protobuf
+12 more
Bump idna from 3.13 to 3.15
Closed 2 months ago
SciQLop/speasy #328
pip:idna
Bump idna from 3.11 to 3.15
Closed 2 months ago
rodlec888/scarcity-transition-sim #2
pip:idna
Bump the pip group across 2 directories with 4 updates
Closed 2 months ago
google/dwh-migration-tools #1160
pip:jinja2
pip:protobuf
+2 more
Actions
Advisory Details
| Published: | April 11, 2024 over 2 years ago |
| Updated: | September 10, 2026 25 days ago |
| CVSS Score: | 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| EPSS: | 1.39% 71th percentile |
| Source: | Github |
| Classification: | GENERAL |
| UUID: | GSA_kwCzR0hTQS1qamc3LTJ2NHYteDM4aM4AA670 |
PR Statistics
PR Status
Open
1052 (55.4%)
Merged
198 (10.4%)
Closed
649 (34.2%)
Update Types
Major
2018 (23.8%)
Minor
3135 (36.9%)
Patch
1147 (13.5%)
References
- https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h
- https://nvd.nist.gov/vuln/detail/CVE-2024-3651
- https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
- https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb
- https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml
- https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2
- https://github.com/advisories/GHSA-jjg7-2v4v-x38h