Affected versions of the idna package are vulnerable to Denial of Service due to an incomplete fix for CVE-2024-3651 that still allows specially crafted inputs to consume significant resources during encoding. The idna.encode() function invokes the valid_contexto validator on every label before applying length-based rejection, so payloads such as long repetitions of the Arabic-Indic digit U+0660 or sequences of the Katakana middle dot U+30FB followed by a CJK character cause valid_contexto to perform extensive context-rule processing across each character. A remote attacker who can supply domain-name input to an application that calls idna.encode() without first enforcing the 253-character DNS length limit can submit arbitrarily large strings that drive the validator to exhaust CPU time, resulting in Denial of Service through resource consumption.

Affected versions of the idna package are vulnerable to Denial of Service due to an incomplete fix for CVE-2024-3651 that still allows specially crafted inputs to consume significant resources during encoding. The idna.encode() function invokes the valid_contexto validator on every label before applying length-based rejection, so payloads such as long repetitions of the Arabic-Indic digit U+0660 or sequences of the Katakana middle dot U+30FB followed by a CJK character cause valid_contexto to perform extensive context-rule processing across each character. A remote attacker who can supply domain-name input to an application that calls idna.encode() without first enforcing the 253-character DNS length limit can submit arbitrarily large strings that drive the validator to exhaust CPU time, resulting in Denial of Service through resource consumption.