CVE-2024-3651VulnerabilityPublished 11 Jun 2024Updated 11 Oct 2026

SUSE · security update for python-idna

Affects SUSESource GCVE Database

Authoritative record:CVE-2024-3651· Medium 6.2

Not known to be exploited · CVSS 6.2 Medium : upgrade SUSE to 2.24.1_1 when convenient.

Data as of 26 Oct 2026, 08:30 UTC

CVSS base score

6.2Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 1.3% chance of exploitation in 30 days – higher than 72% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 2.24.1_1, 0.42.0_1, 0.29.0_1 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 7 Jul 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
Homebrewlocust`pkg:brew/locust`Other threats	Affected >=2.2.1 <2.24.1_1	Fixed in 2.24.1_1
Homebrewtoot`pkg:brew/toot`Other threats	Affected >=0.26.0 <0.42.0_1	Fixed in 0.42.0_1
Homebrewuvicorn`pkg:brew/uvicorn`Other threats	Affected >=0.23.2 <0.29.0_1	Fixed in 0.29.0_1
Homebrewpdm`pkg:brew/pdm`Other threats	Affected >=2.0.0 <2.14.0	Fixed in 2.14.0
Homebrewrobot-framework`pkg:brew/robot-framework`Other threats	Affected <7.4.2_2	Fixed in 7.4.2_2
Homebrewmoto`pkg:brew/moto`Other threats	Affected >=2.0.2 <5.0.5_1	Fixed in 5.0.5_1
Homebrewosc-cli`pkg:brew/osc-cli`Other threats	Affected >=1.6 <1.11.0_4	Fixed in 1.11.0_4

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released updated python-idna packages (version 2.5-5.el8_8.1) for Red Hat Enterprise Linux 8.8 Extended Update Support to fix this vulnerability. Users should apply these updates promptly after ensuring all previously released errata relevant to their system have been applied. Refer to Red Hat's official advisory RHSA-2024:3543 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance.

Description

### Impact A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. ### Patches The function has been refined to reject such strings without the associated resource consumption in version 3.7. ### Workarounds Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application. ### References * https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb

Impact

An attacker can cause a denial of service by triggering resource exhaustion in the python-idna library through crafted inputs to the idna.encode() function. This could disrupt services or applications relying on this library on affected Red Hat Enterprise Linux 8.8 systems. There are no known exploits in the wild at this time.

Summary

CVE-2024-3651 is a vulnerability in the python-idna package where specially crafted inputs to the idna.encode() function can cause excessive resource consumption, leading to a denial of service condition. This issue is classified under CWE-400 (Uncontrolled Resource Consumption). Red Hat has issued a security advisory (RHSA-2024:3543) providing updated python-idna packages for Red Hat Enterprise Linux 8.8 Extended Update Support variants to fix this vulnerability. The advisory rates the security impact as moderate and recommends applying the update after ensuring all prior errata are installed.

CWE-400Uncontrolled Resource Consumption (opens in a new tab)
Class weaknessLikelihood of exploit: High
The product does not properly control the allocation and maintenance of a limited resource.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place.
Architecture and Design
Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or; uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Regular Expression Exponential Blowup (opens in a new tab)
Sustained Client Engagement (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Jul 2026, 01:33 UTC

WeaknessesCWE-400

Technical details

References

Community reviews

Related threats