Denial of Service via Quadratic Complexity in kjd/idna

Vulnerability

Overview

CVE-2024-3651 describes a denial-of-service (DoS) weakness in the kjd/idna library, specifically in the idna.encode() function, affecting version 3.6 [1]. The root cause is an algorithmic inefficiency: when the function is fed a specially crafted input string, its execution time increases quadratically with the length of the input [1]. This behavior is a classic algorithmic complexity vulnerability that can be exploited to consume excessive CPU resources.

Exploitation

Prerequisites

An attacker can trigger the vulnerability by sending a malformed domain name or other input that is passed to idna.encode() without any special privileges or network position [1][3]. No authentication is required, and the attack can be mounted remotely if the library is used in a service that processes user-supplied domain names. The idna library is widely used as a drop-in replacement for Python's standard encodings.idna module, as noted in its GitHub repository [2].

Impact

Successful exploitation leads to a denial-of-service condition. An attacker can cause the affected application to consume significantly more CPU time than normal, potentially making it unresponsive or causing resource exhaustion [1]. This could impact any service that process external input through idna.encode(), including web servers, email handlers, or any Python application relying on this library for internationalized domain name conversion.

Mitigation

Status

The vulnerability is present only in version 3.6 of the idna library. The PyPI advisory database marks it as a confirmed issue [3]. Users should upgrade to a patched version (3.7 or later) as soon as possible; at the time of publication, no workaround other than updating has been documented [1][2]. Organizations using Fedora Linux should watch for updated packages via the official channels [4].