PoC Index85,100 CVEs with PoCs

CVE-2024-3651

Denial of Service via Quadratic Complexity in kjd/idna

MEDIUM 6.9EPSS 1.4%

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

Affected
kjd · kjd/idna
CVSS v4.0 GitHub
6.9 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS v3.1 NVD
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3.1 GitHub
6.2 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3.0 HUNTR
6.2 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.39% chance of exploitation in the next 30 days, 72nd percentile
Published
2024-07-07
Updated
2025-11-04

Proof-of-concept exploits (1)

Security advisories

References