CVE-2026-45409 describes an inefficient regular expression complexity vulnerability (CWE-1333) in the kjd idna library for Python versions before 3.15. The vulnerability involves the valid_contexto function processing long inputs such as repeated Unicode characters before length rejection, causing excessive processing time. This vulnerability is similar to CVE-2024-3651, but the original fix was incomplete. The vulnerability can be triggered by passing arbitrarily large inputs to the idna.encode() function, potentially leading to denial-of-service due to resource exhaustion. Starting in version 3.14, the library began rejecting long inputs earlier to reduce resource consumption, and version 3.15 extended this to additional functions. A practical workaround is to enforce the maximum domain name length of 253 characters before invoking idna.encode().

An attacker can cause a denial-of-service condition by supplying specially crafted, excessively long inputs to the idna.encode() function, which leads to inefficient regular expression processing and high resource consumption. This can degrade service availability. The issue only occurs with inputs that exceed normal domain name lengths and would not typically arise during standard usage.

Upgrade to kjd idna version 3.15 or later, where the vulnerability is fully addressed by early rejection of long inputs. If upgrading is not immediately possible, enforce a maximum domain name length of 253 characters before passing inputs to the idna.encode() function to prevent excessive resource consumption. There is no official patch advisory provided, so check vendor sources for updates.