high7.5
CVE-2022-40023
mako is vulnerable to Regular Expression Denial of Service
Impact
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | mako | < 1.2.2 | 1.2.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sqlalchemy | Mako | before 1.2.2 |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21
- https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c
- https://github.com/sqlalchemy/mako/issues/366
- https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
- https://pyup.io/vulnerabilities/CVE-2022-40023/50870/
- https://lists.debian.org/debian-lts-announce/2025/12/msg00004.html
- https://github.com/advisories/GHSA-v973-fxgf-6xhp
- https://nvd.nist.gov/vuln/detail/CVE-2022-40023
- https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2022-260.yaml
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
- https://pyup.io/vulnerabilities/CVE-2022-40023/50870