The Python IDNA library provides support for Internationalized Domain Names in Applications. Versions prior to 3.15 do not adequately reject overly long inputs early in processing, specifically in the valid_contexto function, allowing crafted inputs such as repeated Unicode characters to consume significant processing time and resources. This vulnerability is a continuation of CVE-2024-3651, with the original fix incomplete. Starting in version 3.14, the library began rejecting long inputs earlier, and version 3.15 extended this to additional functions. The vulnerability can lead to denial-of-service conditions when unvalidated, arbitrarily large inputs are passed to idna.encode().

An attacker can cause a denial-of-service by providing specially crafted, excessively long inputs to the idna.encode() function, resulting in high resource consumption and potential service disruption. This affects applications using vulnerable versions of the Python IDNA library that do not enforce domain name length limits prior to encoding.

A fix is available starting from Python IDNA library version 3.15, which includes improved early rejection of long inputs to reduce resource consumption. As a workaround, applications should enforce the maximum domain name length of 253 characters before passing inputs to idna.encode(). Users should upgrade to version 3.15 or later to fully mitigate this issue.