CVE-2019-19588: Infinite Loop Vulnerability in validators Package
Summary
PYSEC-2019-64: The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. Affects validators versions >= 0.12.2, < 0.12.6. Fixed in 0.12.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The validators package is a Python library available on PyPI that provides a set of functions for validating various types of data. It is commonly used for validating input data in web applications, ensuring that it meets specific criteria. The package includes functions for validating domains, email addresses, URLs, and more.
Vulnerability Detail
The validators package versions 0.12.2 through 0.12.5 are affected by an infinite loop vulnerability. When the validators.domain function is called with a crafted domain string, the package enters an infinite loop, causing the application to hang indefinitely. This vulnerability can be exploited by an attacker to disrupt the functionality of an application that relies on the validators package for domain validation.
How To Fix
Latest published version: 0.36.0 as of 23 Oct 2026
pip install --upgrade "validators==0.36.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.6
This is the first release that contains the fix.
pip install --upgrade "validators==0.12.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the validators package to the fixed version to mitigate the risk of exploitation.
Conclusion
The validators package versions 0.12.2 through 0.12.5 are vulnerable to an infinite loop issue when validating domains. This can be exploited to cause a denial-of-service condition in applications that rely on the package for domain validation. It is crucial to update the package to version 0.12.6 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for validators →
FAQ
The validators package is a Python library used for data validation in web applications. It provides functions for validating domains, email addresses, URLs, and more.
Versions 0.12.2 through 0.12.5 of the validators package are affected by this vulnerability.
This vulnerability can be exploited to cause an application using the validators package to hang indefinitely, leading to a denial-of-service condition.
To fix this vulnerability, update the validators package to version 0.12.6 or later using the 'pip install --upgrade validators' command.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for validators.
