Threats tagged 'brew-icloudpd-cve-2026-45409'

A vulnerability in icloudpd's use of the idna.encode() function allows specially crafted inputs to cause excessive resource consumption, leading to denial-of-service. This issue is a follow-up to CVE-2024-3651, where the initial fix was incomplete. Versions from 1.17.3 up to but not including 1.33.0 are affected. The vulnerability is mitigated in version 1.33.0 by rejecting long inputs early to prevent resource exhaustion. Enforcing the domain name length limit of 253 characters before calling idna.encode() also mitigates the issue.