ETK-2026-1025Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1025",
  "cve_id": null,
  "display_id": "ETK-2026-1025",
  "ghsa_id": "GHSA-45c3-73f7-pv4m",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "CPU denial of service in dnspython DNS name decompression",
  "summary": "dnspython versions before 2.9.0 can consume excessive CPU while decompressing names in crafted DNS wire messages. An attacker may degrade service or cause denial of service when an application processes untrusted DNS wire-form input.",
  "mitigation": "Upgrade dnspython to version 2.9.0 or later. Restrict or filter untrusted DNS wire-form messages until the update is deployed.",
  "vendor": "pip",
  "product": "pip:dnspython",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.9.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "2.9.0"
      ],
      "package_name": "dnspython",
      "purl": "pkg:pypi/dnspython"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.195891616666668,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T00:13:25+00:00",
      "days": -12.193083509837964,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:27.437757+00:00",
      "url": "https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m"
    }
  }
}