Skip to content
Fencer Vulns
medium 6.2

CVE-2024-3651 json

Denial of Service via Quadratic Complexity in kjd/idna

published 2024-04-11 2 y ago modified 2026-09-10 1 mo ago also GHSA-jjg7-2v4v-x38h , PYSEC-2024-60 , EUVD-2024-0077

cvss
6.2
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

Patch / fix

  • pypi idna 3.7
  • kjd kjd/idna 3.7
  • python-idna Debian 12 3.3-1+deb12u1
  • python-idna Debian 14, Debian 13 3.6-2.1

debian advisories DEBIAN-CVE-2024-3651

  • python-pip Ubuntu 22.04 LTS 22.0.2+dfsg-1ubuntu0.7
  • python-pip Ubuntu 24.04 LTS 24.0+dfsg-1ubuntu1.3
  • python-idna Ubuntu 20.04 LTS 2.8-1ubuntu0.1
  • python-idna Ubuntu 22.04 LTS 3.3-1ubuntu0.1
  • python-idna Ubuntu 24.04 LTS 3.6-2ubuntu0.1
  • python-pip Ubuntu Pro 16.04 LTS 8.1.1-2ubuntu0.6+esm8
  • python-pip Ubuntu Pro 18.04 LTS 9.0.1-2.3~ubuntu1.18.04.8+esm4
  • python-pip Ubuntu Pro 20.04 LTS 20.0.2-5ubuntu1.10+esm2

ubuntu advisories UBUNTU-CVE-2024-3651

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
  • python-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
  • python-black ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 22.8.0-2.el9ap
  • python3-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
  • python-jinja2 ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 3.1.4-1.el9ap

red hat advisories RHSA-2024:8365RHSA-2024:3781RHSA-2024:4260RHSA-2024:3846RHSA-2024:3543RHSA-2024:3552

  • venv-salt-minion Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:SaltBundle:Update 3006.0-1.47.1
  • saltbundlepy EL-9:Update:Products:SaltBundle:Update 3.11.9-1.26.1
  • saltbundlepy-core EL-9:Update:Products:SaltBundle:Update 3.11.9-1.26.1
  • saltbundlepy-idna EL-9:Update:Products:SaltBundle:Update 3.4-1.9.2
  • saltbundlepy-zipp EL-9:Update:Products:SaltBundle:Update 3.15.0-1.9.2
  • saltbundlepy-docker EL-9:Update:Products:SaltBundle:Update 7.0.0-1.8.1
  • saltbundlepy-passlib EL-9:Update:Products:SaltBundle:Update 1.7.4-1.3.1
  • saltbundlepy-urllib3 EL-9:Update:Products:SaltBundle:Update 2.0.7-1.12.1

suse advisories SUSE-EL-9-CLIENT-TOOLS-2024-4029SUSE-SU-2024:4029-1SUSE-SU-2024:4021-1SUSE-SU-2024:4020-1SUSE-SU-2024:1939-1SUSE-SU-2024:1439-2

  • python-idna openSUSE Tumbleweed 3.19-1.1
  • python-idna openSUSE Tumbleweed 3.7-1.1

opensuse advisories openSUSE-SU-2026:11711-1openSUSE-SU-2024:13874-1

  • python3-idna AlmaLinux 8 2.5-7.el8_10
  • python3-idna AlmaLinux 9 2.10-7.el9_4.1
  • python39 AlmaLinux 8 3.9.19-1.module_el8.10.0+3849+a48d89aa
  • python39-py AlmaLinux 8 1.10.0-1.module_el8.6.0+2780+a40f65e1
  • python39-pip AlmaLinux 8 20.2.4-9.module_el8.10.0+3765+2f9a457d
  • python39-ply AlmaLinux 8 3.11-10.module_el8.6.0+2780+a40f65e1
  • python39-six AlmaLinux 8 1.15.0-3.module_el8.6.0+2780+a40f65e1
  • python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+2780+a40f65e1

almalinux advisories ALSA-2024:4260ALSA-2024:3846ALSA-2024:3466

  • python-idna Rocky Linux 8 2.5-7.el8_10
  • python-idna Rocky Linux 9 2.10-7.el9_4.1
  • numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1582+bc278001
  • scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1582+bc278001
  • Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1582+bc278001
  • pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1582+bc278001
  • PyYAML Rocky Linux 8 5.4.1-1.module+el8.10.0+1582+bc278001
  • mod_wsgi Rocky Linux 8 4.7.1-7.module+el8.10.0+1582+bc278001

rocky linux advisories RLSA-2024:4260RLSA-2024:3846RLSA-2024:3466

  • py3-idna Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 3.7-r0

alpine advisories ALPINE-CVE-2024-3651

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-idna CBL-Mariner 2.0, Azure Linux 3.0 3.7-1
  • tensorflow Azure Linux 3.0 2.16.1-7
  • python-pip Azure Linux 3.0 24.0-2
  • python3 CBL-Mariner 2.0 3.9.19-13

azure linux advisories AZL-43201AZL-43204AZL-43207AZL-43210AZL-59690

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-3651 updated cvss 6.5

python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()

  • Red Hat Enterprise Linux 8 python-idna, python3-idna
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 python2-idna
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Satellite 6 python-idna, python3-idna, python-idna-ssl, python3-idna-ssl, ansiblerole-foreman_scap_client
    affected: workaround, no fix available
  • Red Hat Update Infrastructure 4 for Cloud Providers python-idna, python-idna-ssl
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-idna 3.7-1.el8ap, python3x-idna 3.7-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-idna 3.7-1.el9ap, python3-idna 3.7-1.el9ap
    fixed: vendor fix RHSA-2024:3781
  • Red Hat Enterprise Linux AppStream (v. 8) scipy 1.5.4-5.module+el8.9.0+19644+d68f775d, numpy 1.19.4-3.module+el8.9.0+19644+d68f775d, PyYAML 5.4.1-1.module+el8.9.0+19644+d68f775d, mod_wsgi 4.7.1-7.module+el8.9.0+19644+d68f775d, python-ply 3.11-10.module+el8.9.0+19644+d68f775d, python39 3.9.19-1.module+el8.10.0+21815+bb024982, +49 more
    fixed: vendor fix RHSA-2024:3466
  • Red Hat Enterprise Linux BaseOS (v. 8) python-idna 2.5-7.el8_10, python3-idna 2.5-7.el8_10
    fixed: vendor fix RHSA-2024:4260
  • Red Hat Enterprise Linux BaseOS (v. 9) python-idna 2.10-7.el9_4.1, python3-idna 2.10-7.el9_4.1
    fixed: vendor fix RHSA-2024:3846
show 6 more
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-idna 2.5-5.el8_6.1, python3-idna 2.5-5.el8_6.1 Red Hat Enterprise Linux BaseOS E4S (v.8.6) python-idna 2.5-5.el8_6.1, python3-idna 2.5-5.el8_6.1
    fixed: vendor fix RHSA-2024:3552
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) python-idna 2.5-5.el8_8.1, python3-idna 2.5-5.el8_8.1
    fixed: vendor fix RHSA-2024:3543
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) python-idna 2.5-5.el8_6.1, python3-idna 2.5-5.el8_6.1
    fixed: vendor fix RHSA-2024:3552
  • Red Hat Enterprise Linux CRB (v. 8) pytest 6.0.2-2.module+el8.9.0+19644+d68f775d, Cython 0.29.21-5.module+el8.9.0+19644+d68f775d, pybind11 2.7.1-1.module+el8.9.0+19644+d68f775d, python-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python39-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python-attrs 20.3.0-2.module+el8.9.0+19644+d68f775d, +16 more
    fixed: vendor fix RHSA-2024:3466
  • Red Hat Enterprise Linux Server (v. 7 ELS) python-idna 2.4-2.el7_9
    fixed: vendor fix RHSA-2024:8365
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.8-1.el8ap, receptorctl 1.4.8-1.el8ap, ansible-core 2.15.11-1.el8ap, ansible-test 2.15.11-1.el8ap, automation-hub 4.9.2-1.el8ap, python39-black 22.8.0-2.el8ap, +37 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.8-1.el9ap, receptorctl 1.4.8-1.el9ap, python-black 22.8.0-2.el9ap, python-jinja2 3.1.4-1.el9ap, ansible-core 2.15.11-1.el9ap, ansible-test 2.15.11-1.el9ap, +37 more Red Hat Enterprise Linux 10 python-idna Red Hat Software Collections rh-python38-python-idna
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.39% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi idna
<3.7
>=0.1, <3.7
3.7

Affected products

  • kjd kjd/idna

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.