A flaw in the dns.name.from_wire_parser function of the dnspython library causes it to follow attacker‑controlled DNS compression pointers without any limit on the number of hops. When a malicious DNS wire-format message contains a long pointer chain, the parser traverses these pointers repeatedly, consuming excessive CPU resources. The result is application slowdown, degradation of service, or a full denial of service. This vulnerability is categorized as CWE‑674 (Unchecked Loop Condition). It also represents a missing input validation flaw (CWE‑606).

The affected product is rthalley:dnspython, versions prior to 2.9.0. Any Python application that imports dnspython and parses DNS messages from external or untrusted sources may be impacted. Applications that rely on dnspython for DNS resolution, filtering, or monitoring are at risk unless they upgrade to 2.9.0 or later.

The CVSS score of 7.5 indicates a high likelihood of serious disruption. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the receipt of a crafted DNS packet over the network; the attacker need not authenticate, only send a DNS message that triggers excessive pointer dereferencing. With sufficient network bandwidth and a vulnerable instance, the attacker can exhaust CPU resources and cause a denial of service. The flaw also falls under CWE‑606, highlighting missing input validation.