Security fix for CVE-2026-45409: IDNA encode/decode and
check_label now reject inputs exceeding the maximum DNS domain
length before per-codepoint validation runs. This prevents
CONTEXTO-heavy labels from driving validation into quadratic
time. The patch was adapted for v2.10 compatibility by using
IncrementalEncoder directly from idna.codec instead of the
'idna2008' codec name introduced in v3.x.
CVE: CVE-2026-45409
Upstream patches:
- c0dda4501d.patch
- e1cb465b63.patch
Resolves: RHEL-215653
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
