From 5ea75ea155bd434b851c11c8aff1236a2f62ccc0 Mon Sep 17 00:00:00 2001
From: Stan Ulbrych <stan@python.org>
Date: Mon, 10 Aug 2026 10:29:26 +0100
Subject: [PATCH] Add warning about untrusted input to the `idna` codec

---
 Doc/library/codecs.rst | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/Doc/library/codecs.rst b/Doc/library/codecs.rst
index e0e69e71e843e7..311437a67f6e81 100644
--- a/Doc/library/codecs.rst
+++ b/Doc/library/codecs.rst
@@ -1395,6 +1395,15 @@ encodings.
 |                    |         | :mod:`encodings.idna`.    |
 |                    |         | Only ``errors='strict'``  |
 |                    |         | is supported.             |
+|                    |         |                           |
+|                    |         | .. warning::              |
+|                    |         |                           |
+|                    |         |    This codec builds on   |
+|                    |         |    ``punycode``, whose    |
+|                    |         |    algorithms scale       |
+|                    |         |    poorly, so limit the   |
+|                    |         |    length of untrusted    |
+|                    |         |    input.                 |
 +--------------------+---------+---------------------------+
 | mbcs               | ansi,   | Windows only: Encode the  |
 |                    | dbcs    | operand according to the  |
@@ -1646,6 +1655,11 @@ Applications) and :rfc:`3492` (Nameprep: A Stringprep Profile for
 Internationalized Domain Names (IDN)). It builds upon the ``punycode`` encoding
 and :mod:`stringprep`.
 
+.. warning::
+
+   This module builds on ``punycode``, whose algorithms scale poorly, so limit
+   the length of untrusted input.
+
 If you need the IDNA 2008 standard from :rfc:`5891` and :rfc:`5895`, use the
 third-party :pypi:`idna` module.