--- title: "CVE-2026-45409\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2026-45409?format=md keywords: index, follow --- # CVE-2026-45409 Publication date 5 June 2026 Last updated 16 July 2026 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **5.3 · Medium** [Score breakdown](https://ubuntu.com/security/CVE-2026-45409?format=md#impact-score) Toggle side navigation ## Description Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" \* N` or `"\u30fb" \* N + "\u6f22"` utilize the `valid\_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application. [Read the notes from the security team](https://ubuntu.com/security/CVE-2026-45409?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | python-idna | 26.04 LTS resolute | Fixed 3.11-1ubuntu0.1 | | 25.10 questing | Ignored end of life, was needs-triage | | 24.04 LTS noble | Fixed 3.6-2ubuntu0.2 | | 22.04 LTS jammy | Fixed 3.3-1ubuntu0.2 | | 20.04 LTS focal | Needs evaluation | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Needs evaluation | | python-pip | 26.04 LTS resolute | Needs evaluation | | 25.10 questing | Ignored end of life, was needs-triage | | 24.04 LTS noble | Needs evaluation | | 22.04 LTS jammy | Needs evaluation | | 20.04 LTS focal | Needs evaluation | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Needs evaluation | | 14.04 LTS trusty | Needs evaluation | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2026-45409?format=md#patch-details) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) On focal and earlier, the python-pip package bundles python-idna binaries when built. After updating python-idna, a no-change rebuild of python-pip is required. On jammy and later, python-idna is bundled in the python-pip package and needs to be patched. ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | python-idna | * Upstream: [c0dda45](https://github.com/kjd/idna/commit/c0dda4501df5d91c3181ce6f962dc5de74e82cc1) * Upstream: [628fef8](https://github.com/kjd/idna/commit/628fef84d3eda59321c21127e73dcd873db23ead) * Upstream: [e1cb465](https://github.com/kjd/idna/commit/e1cb465b6376f33306a26f467d197edbcd01c4b9) | ## Severity score breakdown CVSS version: CVSS v4.0 [CVSS v4.0](https://ubuntu.com/security/CVE-2026-45409?format=md) [CVSS v3.0](https://ubuntu.com/security/CVE-2026-45409?format=md) **Base score** 6.9 · Medium * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Attack requirements | None | | Privileges required | None | | User interaction | None | | Vulnerable system - Confidentiality impact | None | | Vulnerable system - Integrity impact | None | | Vulnerable system - Availability impact | Low | | Subsequent system - Confidentiality impact | None | | Subsequent system - Integrity impact | None | | Subsequent system - Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 6.9 · Medium | | Base + Threat score | - | | Base + Environmental score | - | | Base + Threat + Environmental score | - | **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45409) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-45409) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-45409) * [Debian](https://security-tracker.debian.org/tracker/CVE-2026-45409) ### Related Ubuntu Security Notices (USN) + [USN-8549-1](https://usn.ubuntu.com/USN-8549-1) + idna vulnerability + 15 July 2026 ### Other references * *