CVE-2024-3651 – A denial-of-service vulnerability exists in the... (How to Fix)

📋 TL;DR

A denial-of-service vulnerability exists in the kjd/idna library's idna.encode() function where specially crafted input strings trigger quadratic computational complexity. This causes excessive processing time that can exhaust system resources and make services unresponsive. Any application using vulnerable versions of this library for Internationalized Domain Name processing is affected.

💻 Affected Systems

Products:

kjd/idna library
Applications using kjd/idna for IDN processing

Versions: Version 3.6 specifically

Operating Systems: All operating systems using Python

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects applications that call idna.encode() with untrusted input. The vulnerability is in the library itself, not dependent on specific configurations.

📦 What is this software?

Internationalized Domain Names In Applications by Kjd

View all CVEs affecting Internationalized Domain Names In Applications →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to CPU exhaustion, potentially affecting multiple dependent services in a chain reaction.

🟠

Likely Case

Degraded performance and intermittent service disruptions when processing maliciously crafted domain names.

🟢

If Mitigated

Minimal impact with proper input validation and resource limits in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending crafted input to the vulnerable function, which is straightforward for attackers. The bounty program references indicate active research.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after commit 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d

Vendor Advisory: https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d

Restart Required: No

Instructions:

1. Update the idna library using pip: pip install --upgrade idna
2. Verify the installed version is 3.7 or higher
3. Restart any Python applications using the library

🔧 Temporary Workarounds

Input Validation and Length Limits

all

Implement strict input validation and length limits on strings passed to idna.encode()

# Python example: validate input before encoding
if len(input_string) > 100:
    raise ValueError('Input too long')
# Additional validation for allowed characters

Resource Limiting

linux

Use process/thread resource limits to prevent CPU exhaustion

# Linux: ulimit -t 30  # CPU time limit in seconds
# Container: docker run --cpus="1.0" ...

🧯 If You Can't Patch

Implement strict input validation and sanitization for all inputs to idna.encode() functions
Deploy rate limiting and monitoring for abnormal CPU usage patterns

🔍 How to Verify

Check if Vulnerable:

Check Python environment for idna version 3.6: python -c "import idna; print(idna.__version__)"

Check Version:

python -c "import idna; print('idna version:', idna.__version__)"

Verify Fix Applied:

Verify idna version is 3.7 or higher and test with known malicious inputs

📡 Detection & Monitoring

Log Indicators:

Unusually long processing times for IDN encoding operations
High CPU usage by Python processes calling idna functions

Network Indicators:

Repeated requests with specially crafted domain names
Traffic patterns targeting IDN processing endpoints

SIEM Query:

source="application.logs" AND ("idna.encode" OR "IDN processing") AND duration>5s

📊 Metadata

CVE ID: CVE-2024-3651

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-1333

Published: July 7, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3651, you might also want to check these: