PkgSeer

Vulnerability PYSEC-2026-2472

Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
July 13, 2026 at 02:20 PM UTC
Potential DoS via the Tudoor mechanism in eventlet and dnspython
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1

Summary

Potential DoS via the Tudoor mechanism in eventlet and dnspython

Details

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown
4 months ago
Eventlet affected by HTTP request smuggling in unparsed trailers
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 PYSEC-2026-1350
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 PYSEC-2026-1350
Medium Risk
1 year ago
Eventlet affected by HTTP request smuggling in unparsed trailers
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 GHSA-hw6f-rjfj-j7j7
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 GHSA-hw6f-rjfj-j7j7
Medium Risk
2 years ago
Potential DoS via the Tudoor mechanism in eventlet and dnspython
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1 GHSA-3rq5-2g8h-59hc
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1 GHSA-3rq5-2g8h-59hc
Medium Risk
5 years ago
Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet
0.10.0 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.30.3 GHSA-9p9m-jm8w-94p2
0.10.0 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.30.3 GHSA-9p9m-jm8w-94p2
Unknown
5 years ago
No summary available
0.10.0 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.30.3 PYSEC-2021-12
0.10.0 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.30.3 PYSEC-2021-12
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
4 months ago
July 13, 2026 at 02:20 PM UTC
Fixed (0.35.2)
2 years ago
February 21, 2024 at 05:05 PM UTC
Last Modified
4 months ago
July 13, 2026 at 04:42 PM UTC