Hi,

The following vulnerability was published for python-idna.

CVE-2026-45409[0]:
| Internationalized Domain Names in Applications (IDNA) for Python
| provides support for Internationalized Domain Names in Applications
| (IDNA) and Unicode IDNA Compatibility Processing. In versions prior
| to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N +
| "\u6f22"` utilize the `valid_contexto` function prior to length
| rejection, and for high values of `N` will take a long time to
| process. This is the same issue as CVE-2024-3651, however the
| original remediation in 2024 was not a complete fix. A specially
| crafted argument to the `idna.encode()` function could consume
| significant resources. This may lead to a denial-of-service.
| Starting in version 3.14, the function rejects long inputs as soon
| as practicable prior to any further processing to minimize resource
| consumption. In version 3.15, this approach was extended to lesser
| used alternate functions (i.e. per-label conversions and codec
| support). A workaround is available. Domain names cannot exceed 253
| characters in length. If this length limit is enforced prior to
| passing the domain to the `idna.encode()` function, it should no
| longer consume significant resources. This is triggered by
| arbitrarily large inputs that would not occur in normal usage, but
| may be passed to the library assuming there is no preliminary input
| validation by the higher-level application.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-45409
https://www.cve.org/CVERecord?id=CVE-2026-45409
[1] https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx
[2] https://github.com/kjd/idna/commit/628fef84d3eda59321c21127e73dcd873db23ead
[3] https://github.com/kjd/idna/commit/e1cb465b6376f33306a26f467d197edbcd01c4b9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Dear maintainer,

I've prepared an NMU for python-idna (versioned as 3.11-1.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I should
cancel it.

cu
Adrian

We believe that the bug you reported is fixed in the latest version of
python-idna, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139164@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Adrian Bunk <bunk@debian.org> (supplier of updated python-idna package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 23 Jun 2026 17:01:51 +0300
Source: python-idna
Architecture: source
Version: 3.11-1.1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Adrian Bunk <bunk@debian.org>
Closes: 1139164
Changes:
 python-idna (3.11-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-45409: DoS from specially crafted inputs (Closes: #1139164)
Checksums-Sha1:
 723302442994ff8676719bae5196c168224992c3 2097 python-idna_3.11-1.1.dsc
 cf3722da461dc4bc8da5accca32304b8e35bce02 7572 python-idna_3.11-1.1.debian.tar.xz
Checksums-Sha256:
 8a5fd52eddff7946d75557f7d1c2c87274196185dd6b163a8572cb275f066947 2097 python-idna_3.11-1.1.dsc
 443da84b88ad892f74f18a3090295d34f6b3e91edfe55d94dccd0e0aa06d5240 7572 python-idna_3.11-1.1.debian.tar.xz
Files:
 5318080156a5f34e89017e4e0ccbaa3f 2097 python optional python-idna_3.11-1.1.dsc
 141dca738cd6565b7b1d8e8555aae815 7572 python optional python-idna_3.11-1.1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmo6k9EACgkQiNJCh6LY
mLEdGRAAlfjw2C+UsyLGq4SCPknEr1KOdCtT6nMe7/YF+t+EwZEHz8DqAQGQMUFF
DXRSEUkGySXDgaN64ThCCaytbhQ0P3IdsP+p2dvQLaFf4muTO1fhUrS4R5JFSvpN
ikY1sRz92949tCW0B4hgc27SO7DrU/d0At6shGms8j89IIcDV1kOf88w5jHvFiZ7
CfGZidpnVnsuY1A+vUxALaCR7r0I+eSNbkMV7bK7yThdr2Y/AUCIK30Jfxxv6k1t
X6zFeMHkLyDsRhUUoLrxe8P9LMBt5ax2iLZ6nkLONP8N5EE6VRn+a70D5AgiaFu9
iQ2kDx/JK1iPP3DZFi+8BiQnn68fB7zMfQprtH0S3z8yA9DSeaPk/h6vXeIYY2Of
Et+6KHRIyGvaY88ttsiBroaJOxwGWGRTQCopH+Tm6WAUARfnSgODtVNv7flal9xk
sa43LFFPtPbqE7oj95M4SNFZRn6nF9aHrssUQ8BipqHR6ZtAKNwZWm18i7NFq6qB
28lVU+JD1oddVA7owSTLH6ksS4kApgJ4l9i0xPbpNddYAZNCAakUx3JCTqiWB3DC
IuA8dC9qzgzQZ5be+EWWUcfxEGjUanym1CmQfJuwxifesolPF62n1z2/JHIvjBj8
A/4xEMUnFPtCnlqKrKfvfGt9pGSiuog+iiWK4HvPSteU7HYpU6I=
=7FFG
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
python-idna, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139164@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Adrian Bunk <bunk@debian.org> (supplier of updated python-idna package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 27 Jun 2026 20:30:37 +0300
Source: python-idna
Architecture: source
Version: 3.10-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Adrian Bunk <bunk@debian.org>
Closes: 1139164
Changes:
 python-idna (3.10-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-45409: DoS from specially crafted inputs (Closes: #1139164)
Checksums-Sha1:
 b09666a0b0205247c3ae1043b0200fcc7b24b3fd 2123 python-idna_3.10-1+deb13u1.dsc
 fb47f75d124a8141fa1964e3381a40d86d747676 138704 python-idna_3.10.orig.tar.xz
 0b14799966867aa4cb3d80e52be2639d174da835 7536 python-idna_3.10-1+deb13u1.debian.tar.xz
Checksums-Sha256:
 af02f92bbba247bf01bfcf7842a4d5f17ec5330ca00c07ab61b97193bdfd537e 2123 python-idna_3.10-1+deb13u1.dsc
 03af80a86108713070c5b404a22864a5164d7f693c7f7504c2dc839533a184ad 138704 python-idna_3.10.orig.tar.xz
 90f8226b18d1c3bcb04f7a3001071c10c293f047146b87b3ce133d49848630f5 7536 python-idna_3.10-1+deb13u1.debian.tar.xz
Files:
 50529f0f419c8eee5c7f57e60cf343e5 2123 python optional python-idna_3.10-1+deb13u1.dsc
 8a968e3d8edcfa8757e57bf5d016654f 138704 python optional python-idna_3.10.orig.tar.xz
 07f6cde359180ae31382e178f9f8ae77 7536 python optional python-idna_3.10-1+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmpAC04ACgkQiNJCh6LY
mLEFIg//RDDOo8Jbttl5oL76w0KYBkvlwID5I+P0G9sXGr/wqaLd2sIWvlkvFMSf
RxCMq/eWb+OTD5Ox+d5YIJoqzzAYKvc4blnAM1RYQDu15uFnuzfEF09KvHurxjeS
+DwMFMfa80rTl6qpx6zDIM0HHHMyYGAW33veYBh8qhg/X4igWG6lg9z17IYmQndm
BFrFBbqovenbQ3BuWOg0wjxAy6krmVCIm4qGLe6sp+vb07EppOfzkJp+mFZR+2Oj
WFysl0Fq8GwV06iphWnQAfdz/EwFR1hKCYjAyTDT0H3RgC4dYj1AsVHTmH5YH2Ez
dcJmsQL3quDbO/E8KoVxRtJQQiSD4GGDaVH588OpEXWaQ9D2NkGsem7b9daLgDOU
DW4LHpQY1tfZhLD8qRS/NVDtyho7anpbtykRIF3rnhivmn9RzBvHFNCOqSZBZ8cm
s6T0t42c2COu3RiMwPAXlqNudhIILZARwaSSQmumYiH/pqS/PAnM5HbVPu6phihB
7aNTKoE+QJcp4bspw6hrH36VG9gqvVkRcLIDS930xIrV/b2eCuQFJ3m6hAwE1Pln
HE2TIIDosGAKFyDIJv1zsC/ZXqcLuJTt/qesnI55R8Lwb4FPmA/PJWwykpvF5tPv
AKgyE655PueK8kX0dzjPhJyRhzWXvxsHYoKT7zN/hzI3zHkb7Uc=
=yXyc
-----END PGP SIGNATURE-----