ZeroDay Findings
Sign inSign up

Findings

CVE-2022-45061

An issue was discovered in Python before 3.11.1.

Published Nov 9, 2022 · updated Oct 14, 2026 · python python

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 9, 2022 · NIST NVD

    Detected

    An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they coul

  2. Oct 14, 2026 · NIST NVD

    Updated

    An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they coul

Affected

  • cpe fedoraproject/fedora35
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/bootstrap osversion unspecified
  • cpe python/pythonversion unspecified
  • cpe python/python3.11.0

Sources

  • CVE.orgVulnerability recordCVE-2022-45061

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-45061

    30-day exploitation probability 2.7%

    first.org
  • NIST NVDVulnerability recordCVE-2022-45061

    An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hos

    nvd.nist.gov

References