[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
dnspython	2.8.0 → 2.9.0

---

dnspython dns.name.from_wire_parser() excessive CPU use

CVE-2026-114605 / GHSA-45c3-73f7-pv4m

More information

Details

Impact

A maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required.

Patches

This problem is fixed in dnspython 2.9.0.

Workarounds

There are no known workarounds.

Credit

Evgenios Gkritsis, Department of Informatics, University of Piraeus & Athena Research Center, Greece
Constantinos Patsakis, Department of Informatics, University of Piraeus & Athena Research Center, Greece
George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
• https://nvd.nist.gov/vuln/detail/CVE-2026-114605
• https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023
• https://github.com/rthalley/dnspython/releases/tag/v2.9.0
• https://github.com/advisories/GHSA-45c3-73f7-pv4m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rthalley/dnspython (dnspython)

v2.9.0: dnspython 2.9.0

Compare Source

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the dnspython package version from 2.9.0 to 2.9.2 in the uv.lock lockfile, including its corresponding dependency reference for email_validator. I have no feedback to provide on these changes.