CVE-2024-3651: High Denial of Service in Python idna

CVE-2024-3651 is a high severity denial of service (CVSS 7.5) in the Python idna library. In version 3.6, crafted input to idna.encode() takes quadratic time, so a short stream of requests can tie up a service. It is fixed in idna 3.7, released 11 April 2024. Upgrade, and cap the length of hostnames you accept.

Weakness class: CWE-1333.

What's affected

• Product: kjd/idna, the Internationalized Domain Names in Applications library for Python, installed from PyPI as idna.
• Affected: version 3.6, per the record description.
• Fixed: 3.7. The release commit history entry is dated 11 April 2024 and names CVE-2024-3651.
• Component: the idna.encode() function.
• Severity: High, CVSS 7.5, per the record. The KEV flag is false.
• Debian and Fedora published their own advisories, so distribution packages may carry backported fixes with different version numbers.

How to check if you're exposed

1. Run pip show idna in each environment, or pip list | grep -i idna.
2. For a project with a lock file, search requirements.txt, poetry.lock and Pipfile.lock for idna.
3. In containers, run pip show idna inside the container image with docker run.
4. The library is a transitive dependency of requests and many other packages, so check lock files, not only direct requirements.
5. Scan with the free in-browser dependency scan to list every environment with idna 3.6.

What to do now

1. Upgrade idna to 3.7 or later: use pip to install idna 3.7 or newer.

pip install --upgrade "idna>=3.7"

2. Regenerate lock files and rebuild container images, so the fix reaches production.
3. For Debian or Fedora system packages, install the distribution update that references the CVE.
4. Add input limits: reject hostnames longer than 253 characters before they reach encode().
5. Add a timeout or rate limit on endpoints that accept user supplied URLs.

Why it matters

The class is CWE-1333, inefficient regular expression complexity, which in practice means an algorithm whose cost grows faster than the input. Quadratic behavior is small for normal hostnames and expensive for crafted ones. Doubling the input size multiplies the work by four.

This is a useful reminder that denial of service bugs in widely shared libraries matter because of where the library sits. idna runs underneath HTTP clients, so any service that fetches user supplied URLs may be exposed through a dependency its authors never chose directly.

Dependency inventory is the main control. If you cannot list where idna 3.6 is installed, you cannot say whether you are exposed.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
• Gold entry for CVE-2024-3651

Last reviewed: 19 October 2026.