CVE-2019-19588: Uncontrolled resource consumption in validators Python package
Summary
CVE-2019-19588: Uncontrolled resource consumption in validators Python package. Affects validators versions >= 0.12.2, < 0.12.6. Fixed in 0.12.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The validators package is a Python library that provides a set of functions for validating various types of data, such as email addresses, URLs, and domains. It is commonly used in web development projects to ensure the validity of user input. The package version 0.12.2 through 0.12.5 is affected by a vulnerability that allows for uncontrolled resource consumption when the validators.domain function is called with a crafted domain string. This vulnerability can lead to an infinite loop, causing excessive CPU and memory usage, and potentially resulting in denial of service.
Vulnerability Detail
The vulnerability in the validators package arises from a lack of proper input validation when processing domain strings. By providing a specially crafted domain string, an attacker can trigger an infinite loop in the validators.domain function. This can lead to a significant drain on system resources, potentially causing the application to become unresponsive or crash. The impact of this vulnerability is particularly severe as it allows for a denial of service attack without requiring any authentication or user interaction. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 0.36.0 as of 23 Oct 2026
pip install --upgrade "validators==0.36.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.6
This is the first release that contains the fix.
pip install --upgrade "validators==0.12.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the validators package to mitigate the risk.
Conclusion
The validators package version 0.12.2 through 0.12.5 for Python is vulnerable to uncontrolled resource consumption, leading to an infinite loop and potential denial of service. It is crucial to update to version 0.12.6 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for validators →
FAQ
The validators package is a Python library used for data validation in web development projects. It provides functions for validating various types of data, such as email addresses, URLs, and domains.
The vulnerability allows for uncontrolled resource consumption, leading to an infinite loop and excessive CPU and memory usage. This can result in denial of service, potentially causing the application to become unresponsive or crash.
To fix this vulnerability, update the validators package to version 0.12.6 or later using the command pip install --upgrade validators.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed version of the validators package.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for validators.
