A flaw was found in the PyPI package dnspython
KROMSE explanation
A serious flaw in the PyPI package dnspython (CVE-2026-128089, CVSS 7.5). The official record says: dnspython is a DNS toolkit for Python. Prior to version 2.9.2, the from_text() parser for WKS records does not require the service number to be between 0 and 65535 before using it as a bitmap offset.
No confirmed attacks and no public attack code yet.
Projects that use the PyPI package dnspython.
- Update dnspython to 2.9.2 or later.
- Not sure if you use it? KROMSE can check your product for free.
