CVE-2022-45061 is a vulnerability identified in Python versions prior to 3.11.1 that affects the processing of Internationalized Domain Names in Applications (IDNA) decoding as specified by RFC 3490. The issue arises from an inefficient quadratic time complexity algorithm path when handling certain crafted inputs to the IDNA decoder. Specifically, if an attacker supplies an unreasonably long hostname string, the decoder's processing time grows disproportionately, leading to excessive CPU consumption. This behavior can be exploited to cause a denial of service (DoS) condition by exhausting CPU resources on the client system attempting to process the malicious hostname. The vulnerability is particularly relevant because hostnames are often obtained from remote servers, which attackers can control. For example, an attacker could embed the malicious payload within the Location header of an HTTP 302 redirect response, causing clients that automatically follow redirects and process the hostname to experience high CPU usage. The vulnerability does not impact confidentiality or integrity but severely affects availability by enabling resource exhaustion. The flaw is classified under CWE-407 (Improper Resource Management). The issue is addressed in Python releases 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16, where the algorithmic inefficiency has been corrected to prevent the quadratic time complexity scenario. The CVSS v3.1 base score is 7.5 (high), reflecting the network vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability. No known exploits in the wild have been reported to date.

For European organizations, this vulnerability poses a significant risk primarily to systems and applications that rely on vulnerable Python versions for network communications, especially those that parse or handle domain names from external sources such as web clients, web scrapers, or automated redirect handlers. The potential impact includes service degradation or outages due to CPU exhaustion, which can disrupt business operations, degrade user experience, and potentially cause cascading failures in dependent services. Critical infrastructure, financial institutions, and large enterprises with automated systems that process external URLs or redirects are particularly at risk. Since the vulnerability can be triggered remotely without authentication or user interaction, attackers can exploit it at scale to target multiple systems simultaneously. Although it does not compromise data confidentiality or integrity, the availability impact can lead to denial of service conditions affecting business continuity. Additionally, organizations with regulatory requirements around service availability and uptime (such as those governed by GDPR or sector-specific regulations) may face compliance challenges if the vulnerability is exploited.

European organizations should prioritize upgrading all Python environments to the fixed versions: 3.11.1, 3.10.9, 3.9.16, 3.8.16, or 3.7.16, depending on their deployment. For environments where immediate upgrading is not feasible, organizations should implement input validation and sanitization on all externally sourced hostnames before passing them to the IDNA decoder. Specifically, limit the length of domain name inputs to reasonable maximums consistent with DNS standards to prevent processing of unreasonably long names. Network-level controls such as web application firewalls (WAFs) can be configured to detect and block HTTP responses containing suspiciously long or malformed Location headers. Monitoring CPU usage patterns on critical systems can help detect anomalous spikes indicative of exploitation attempts. Additionally, organizations should review and harden any automated HTTP client or redirect-following logic to handle unexpected or malicious inputs gracefully. Security teams should also maintain awareness of Python dependency versions in their software supply chain to ensure vulnerable versions are not inadvertently deployed. Finally, incident response plans should include procedures for detecting and mitigating DoS conditions arising from this vulnerability.