CVE-2019-19588 Uncontrolled resource consumption in validators Python package
An attacker can cause a denial of service by triggering an infinite loop in the Python validators library via a crafted domain string.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19588?
CVE-2019-19588 is a high-severity denial of service vulnerability in n/a, published on 5 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6.
Weakness: CWE-835
Which versions are affected by CVE-2019-19588?
3 open source packages ship an affected version, including validators. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
validators PyPI | From 0.12.2 | 0.12.6 |
validators PyPI | From 0.12.2 | 0.12.6 |
validators PyPI | From 0.12.2 | 0.12.6 |
Linux distribution packages (2)
python-validators openSUSE:Tumbleweed | All versions | 0.24.0-1.2 |
python-validators openSUSE:Tumbleweed | All versions | 0.35.0-1.4 |
Products include Validators Project Validators.
How do I fix CVE-2019-19588?
Upgrade validators to 0.12.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-19588 being exploited?
There is no known exploitation of CVE-2019-19588 in the wild and no public exploit code.
Sources
Also known as GHSA-5qcg-w2cc-xffw, PYSEC-2019-134, openSUSE-SU-2024:11278-1, openSUSE-SU-2024:13811-1, openSUSE-SU-2026:12046-1.