CVE-2022-40023

HIGH

Mako < 1.2.2 - Regular Expression Denial of Service via Lexer Class

Title source: llm

Description

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

References (7)

Core 7

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2025/12/msg00004.html

Exploit, Third Party Advisory

https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21

View Exploit ZIP pw:eip

Patch

https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c

View Patch ZIP pw:eip

Issue Tracking, Patch

https://github.com/sqlalchemy/mako/issues/366

Exploit, Third Party Advisory

https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/

Third Party Advisory

https://pyup.io/vulnerabilities/CVE-2022-40023/50870/

Mailing List, Third Party Advisory mailing-list

https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html

Scores

CVSS v3 7.5

EPSS 0.0162

EPSS Percentile 72.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-1333

Status published

Products (3)

debian/debian_linux 10.0

pypi/mako 0 - 1.2.2PyPI

sqlalchemy/mako < 1.2.2

Published Sep 07, 2022

Tracked Since Feb 18, 2026