CVE catalog
CVE-2024-3651
pip vulnerabilities
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.39% · Oct 25, 2026
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-idna | sid | 3.20-1 | fixed |
| Debian | python-idna | forky | 3.20-1 | fixed |
| Debian | python-idna | trixie | 3.10-1+deb13u1 | fixed |
| Debian | python-idna | bookworm | 3.3-1+deb12u1 | fixed |
| Ubuntu | python-pip | noble | 24.0+dfsg-1ubuntu1.3 | fixed |
| Ubuntu | python3-pip | noble | 24.0+dfsg-1ubuntu1.3 | fixed |
| Ubuntu | python3-pip-whl | noble | 24.0+dfsg-1ubuntu1.3 | fixed |
| Ubuntu | python-idna | noble | 3.6-2ubuntu0.1 | fixed |
| Ubuntu | python3-idna | noble | 3.6-2ubuntu0.1 | fixed |
| PyPI | idna | Not reported | 3.7 | fixed |
| PyPI | idna | Not reported | 3.7 | fixed |
| PyPI | idna | Not reported | 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d | fixed |
| Alpine | py3-idna | 3.19 | 3.7-r0 | fixed |
| Alpine | py3-idna | 3.20 | 3.7-r0 | fixed |
| Alpine | py3-idna | 3.21 | 3.7-r0 | fixed |
| Alpine | py3-idna | 3.22 | 3.7-r0 | fixed |
| Alpine | py3-idna | 3.23 | 3.7-r0 | fixed |
| Alpine | py3-idna | 3.24 | 3.7-r0 | fixed |
| Opensuse | python-idna | tumbleweed | 3.19-1.1 | fixed |
| Ubuntu | python-idna | pro | 2.5-1 | vulnerable |
| Ubuntu | python-idna | pro | 2.6-1 | vulnerable |
| Ubuntu | python-idna | pro | 2.6-1ubuntu0.1~esm1 | fixed |
| Ubuntu | python-idna | 20.04 | 2.6-2 | vulnerable |
| Ubuntu | python-idna | 20.04 | 2.6-2build1 | vulnerable |
| Ubuntu | python-idna | 20.04 | 2.8-1 | vulnerable |
| Ubuntu | python-idna | 20.04 | 2.8-1ubuntu0.1 | fixed |
| Ubuntu | python-idna | 22.04 | 2.10-1 | vulnerable |
| Ubuntu | python-idna | 22.04 | 3.2-2 | vulnerable |
| Ubuntu | python-idna | 22.04 | 3.3-1 | vulnerable |
| Ubuntu | python-idna | 22.04 | 3.3-1ubuntu0.1 | fixed |
| Ubuntu | python-idna | 24.04 | 3.3-2 | vulnerable |
| Ubuntu | python-idna | 24.04 | 3.6-2 | vulnerable |
| Ubuntu | python-idna | 24.04 | 3.6-2ubuntu0.1 | fixed |
| Ubuntu | python-idna | pro | 2.5-1 | vulnerable |
| Ubuntu | python-idna | pro | 2.6-1 | vulnerable |
| Ubuntu | python-idna | pro | 2.6-1ubuntu0.1~esm1 | fixed |
| Ubuntu | python-pip | pro | 18.1-5 | vulnerable |
| Ubuntu | python-pip | pro | 18.1-5build1 | vulnerable |
| Ubuntu | python-pip | pro | 18.1-5ubuntu1 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-2 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-4 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.1 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.3 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.4 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.5 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.6 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.7 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.8 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.9 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.10 | vulnerable |
| Ubuntu | python-pip | pro | 20.0.2-5ubuntu1.10+esm2 | fixed |
| Ubuntu | python-idna | 20.04 | 2.6-2 | vulnerable |
| Ubuntu | python-idna | 20.04 | 2.6-2build1 | vulnerable |
| Ubuntu | python-idna | 20.04 | 2.8-1 | vulnerable |
| Ubuntu | python-idna | 20.04 | 2.8-1ubuntu0.1 | fixed |
| Ubuntu | python-idna | 22.04 | 2.10-1 | vulnerable |
| Ubuntu | python-idna | 22.04 | 3.2-2 | vulnerable |
| Ubuntu | python-idna | 22.04 | 3.3-1 | vulnerable |
| Ubuntu | python-idna | 22.04 | 3.3-1ubuntu0.1 | fixed |
| Ubuntu | python-pip | 22.04 | 20.3.4-4 | vulnerable |
| Ubuntu | python-pip | 22.04 | 21.3.1+dfsg-3 | vulnerable |
| Ubuntu | python-pip | 22.04 | 22.0.2+dfsg-1 | vulnerable |
| Ubuntu | python-pip | 22.04 | 22.0.2+dfsg-1ubuntu0.1 | vulnerable |
| Ubuntu | python-pip | 22.04 | 22.0.2+dfsg-1ubuntu0.2 | vulnerable |
| Ubuntu | python-pip | 22.04 | 22.0.2+dfsg-1ubuntu0.3 | vulnerable |
| Ubuntu | python-pip | 22.04 | 22.0.2+dfsg-1ubuntu0.4 | vulnerable |
| Ubuntu | python-pip | 22.04 | 22.0.2+dfsg-1ubuntu0.5 | vulnerable |
| Ubuntu | python-pip | 22.04 | 22.0.2+dfsg-1ubuntu0.6 | vulnerable |
| Ubuntu | python-pip | 22.04 | 22.0.2+dfsg-1ubuntu0.7 | fixed |
| Ubuntu | python-idna | 24.04 | 3.3-2 | vulnerable |
| Ubuntu | python-idna | 24.04 | 3.6-2 | vulnerable |
| Ubuntu | python-idna | 24.04 | 3.6-2ubuntu0.1 | fixed |
| Ubuntu | python-pip | 24.04 | 23.2+dfsg-1 | vulnerable |
| Ubuntu | python-pip | 24.04 | 23.3+dfsg-1 | vulnerable |
| Ubuntu | python-pip | 24.04 | 24.0+dfsg-1 | vulnerable |
| Ubuntu | python-pip | 24.04 | 24.0+dfsg-1ubuntu1 | vulnerable |
| Ubuntu | python-pip | 24.04 | 24.0+dfsg-1ubuntu1.1 | vulnerable |
| Ubuntu | python-pip | 24.04 | 24.0+dfsg-1ubuntu1.2 | vulnerable |
| Ubuntu | python-pip | 24.04 | 24.0+dfsg-1ubuntu1.3 | fixed |
| Suse | python-idna | linux enterprise micro 5.3 | 2.6-150000.3.3.1 | fixed |
| Suse | python-idna | linux enterprise micro 5.4 | 2.6-150000.3.3.1 | fixed |
| Suse | python-idna | linux enterprise micro 5.5 | 2.6-150000.3.3.1 | fixed |
| Suse | python-idna | linux enterprise module for basesystem 15 sp5 | 2.6-150000.3.3.1 | fixed |
| Suse | python-idna | linux enterprise micro 5.1 | 2.6-150000.3.3.1 | fixed |
| Suse | python-idna | linux enterprise micro 5.2 | 2.6-150000.3.3.1 | fixed |
| Opensuse | python-idna | leap micro 5.3 | 2.6-150000.3.3.1 | fixed |
| Opensuse | python-idna | leap micro 5.4 | 2.6-150000.3.3.1 | fixed |
| Opensuse | python-idna | leap 15.5 | 2.6-150000.3.3.1 | fixed |
| Suse | python-idna | linux enterprise module for public cloud 12 | 2.5-3.13.1 | fixed |
| Suse | python-idna | linux enterprise server 12 sp5 | 2.5-3.13.1 | fixed |
| Suse | python-idna | linux enterprise server for sap applications 12 sp5 | 2.5-3.13.1 | fixed |
| Suse | python-idna | linux enterprise module for public cloud 15 sp4 | 3.4-150400.11.10.1 | fixed |
| Suse | python-idna | linux enterprise module for python 3 15 sp5 | 3.4-150400.11.10.1 | fixed |
| Suse | python-idna | linux enterprise module for python 3 15 sp6 | 3.4-150400.11.10.1 | fixed |
| Opensuse | python-idna | leap 15.5 | 3.4-150400.11.10.1 | fixed |
| Opensuse | python-idna | leap 15.6 | 3.4-150400.11.10.1 | fixed |
| Suse | python-idna | linux enterprise micro 5.5 | 2.6-150000.3.3.1 | fixed |
| Opensuse | python-idna | tumbleweed | 3.7-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-idna | source | sid | 3.6-2.1 | not yet assigned | Not reported | [1069127] |
| Debian | python-idna | source | forky | 3.6-2.1 | not yet assigned | Not reported | [1069127] |
| Debian | python-idna | source | trixie | 3.6-2.1 | not yet assigned | Not reported | [1069127] |
| Debian | python-idna | source | bookworm | 3.3-1+deb12u1 | not yet assigned | Not reported | [1069127] |
| Ubuntu | python-pip | deb | noble | 24.0+dfsg-1ubuntu1.3 | Not reported | Not reported | Not reported |
| Ubuntu | python3-pip | deb | noble | 24.0+dfsg-1ubuntu1.3 | Not reported | Not reported | Not reported |
| Ubuntu | python3-pip-whl | deb | noble | 24.0+dfsg-1ubuntu1.3 | Not reported | Not reported | Not reported |
| Ubuntu | python-idna | deb | noble | 3.6-2ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | python3-idna | deb | noble | 3.6-2ubuntu0.1 | Not reported | Not reported | Not reported |
| PyPI | idna | PyPI | Not reported | 3.7 | Not reported | GHSA-JJG7-2V4V-X38H | Not reported |
| PyPI | idna | PyPI | Not reported | 3.7 | Not reported | Not reported | Not reported |
| PyPI | idna | PyPI | Not reported | 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d | Not reported | Not reported | Not reported |
| Alpine | py3-idna | apk | 3.19 | 3.7-r0 | Not reported | ALPINE-CVE-2024-3651 | Not reported |
| Alpine | py3-idna | apk | 3.20 | 3.7-r0 | Not reported | ALPINE-CVE-2024-3651 | Not reported |
| Alpine | py3-idna | apk | 3.21 | 3.7-r0 | Not reported | ALPINE-CVE-2024-3651 | Not reported |
| Alpine | py3-idna | apk | 3.22 | 3.7-r0 | Not reported | ALPINE-CVE-2024-3651 | Not reported |
| Alpine | py3-idna | apk | 3.23 | 3.7-r0 | Not reported | ALPINE-CVE-2024-3651 | Not reported |
| Alpine | py3-idna | apk | 3.24 | 3.7-r0 | Not reported | ALPINE-CVE-2024-3651 | Not reported |
| Opensuse | python-idna | rpm | tumbleweed | 3.19-1.1 | Not reported | OPENSUSE-SU-2026:11711-1 | Not reported |
| Ubuntu | python-idna | deb | pro | 2.6-1ubuntu0.1~esm1 | Not reported | USN-6780-1 | Not reported |
| Ubuntu | python-idna | deb | 20.04 | 2.8-1ubuntu0.1 | Not reported | USN-6780-1 | Not reported |
| Ubuntu | python-idna | deb | 22.04 | 3.3-1ubuntu0.1 | Not reported | USN-6780-1 | Not reported |
| Ubuntu | python-idna | deb | 24.04 | 3.6-2ubuntu0.1 | Not reported | USN-6780-1 | Not reported |
| Ubuntu | python-idna | deb | pro | 2.6-1ubuntu0.1~esm1 | Not reported | UBUNTU-CVE-2024-3651 | Not reported |
| Ubuntu | python-pip | deb | pro | 20.0.2-5ubuntu1.10+esm2 | Not reported | UBUNTU-CVE-2024-3651 | Not reported |
| Ubuntu | python-idna | deb | 20.04 | 2.8-1ubuntu0.1 | Not reported | UBUNTU-CVE-2024-3651 | Not reported |
| Ubuntu | python-idna | deb | 22.04 | 3.3-1ubuntu0.1 | Not reported | UBUNTU-CVE-2024-3651 | Not reported |
| Ubuntu | python-pip | deb | 22.04 | 22.0.2+dfsg-1ubuntu0.7 | Not reported | UBUNTU-CVE-2024-3651 | Not reported |
| Ubuntu | python-idna | deb | 24.04 | 3.6-2ubuntu0.1 | Not reported | UBUNTU-CVE-2024-3651 | Not reported |
| Ubuntu | python-pip | deb | 24.04 | 24.0+dfsg-1ubuntu1.3 | Not reported | UBUNTU-CVE-2024-3651 | Not reported |
| Suse | python-idna | rpm | linux enterprise micro 5.3 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise micro 5.4 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise micro 5.5 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise module for basesystem 15 sp5 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise micro 5.1 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise micro 5.2 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Opensuse | python-idna | rpm | leap micro 5.3 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Opensuse | python-idna | rpm | leap micro 5.4 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Opensuse | python-idna | rpm | leap 15.5 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise module for public cloud 12 | 2.5-3.13.1 | Not reported | SUSE-SU-2024:1428-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise server 12 sp5 | 2.5-3.13.1 | Not reported | SUSE-SU-2024:1428-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise server for sap applications 12 sp5 | 2.5-3.13.1 | Not reported | SUSE-SU-2024:1428-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise module for public cloud 15 sp4 | 3.4-150400.11.10.1 | Not reported | SUSE-SU-2024:1939-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise module for python 3 15 sp5 | 3.4-150400.11.10.1 | Not reported | SUSE-SU-2024:1939-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise module for python 3 15 sp6 | 3.4-150400.11.10.1 | Not reported | SUSE-SU-2024:1939-1 | Not reported |
| Opensuse | python-idna | rpm | leap 15.5 | 3.4-150400.11.10.1 | Not reported | SUSE-SU-2024:1939-1 | Not reported |
| Opensuse | python-idna | rpm | leap 15.6 | 3.4-150400.11.10.1 | Not reported | SUSE-SU-2024:1939-1 | Not reported |
| Suse | python-idna | rpm | linux enterprise micro 5.5 | 2.6-150000.3.3.1 | Not reported | SUSE-SU-2024:1439-2 | Not reported |
| Opensuse | python-idna | rpm | tumbleweed | 3.7-1.1 | Not reported | OPENSUSE-SU-2024:13874-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11711-1.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2024-3651]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-3651]
- [https://osv.dev/vulnerability/DLA-3811-1]
- [https://osv.dev/vulnerability/GHSA-jjg7-2v4v-x38h]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1428-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1439-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1439-2]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1939-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-3651]
- [https://osv.dev/vulnerability/USN-6780-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13874-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11711-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-3651]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-3651.json]
- [https://ubuntu.com/security/notices/USN-6780-1]
- [https://ubuntu.com/security/notices/USN-7762-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1701.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]