CVE-2024-3651: Denial of Service via Quadratic Complexity in kjd/idna

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-07 · updated 2026-06-17
Weakness: CWE-1333

Description

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

Affected products

kjd Internationalized Domain Names In Applications: from 0.2 before 3.7 — fixed in 3.7
Pypi Idna: from 0.1 before 3.7; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+48) — fixed in 3.7

How to fix

Upgrade to a fixed version: kjd Internationalized Domain Names In Applications 3.7; Pypi Idna 3.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3651 or the next vulnerability affects your stack