CVE-2022-31799
Denial of service in bottle
Bottle before 0.12.20 mishandles errors during early request binding.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
CVE-2022-31799- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-755
- Updated
- 2026-11-02
CVE List No score
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
CVE-2022-31799- Updated
- 2026-11-02
EUVDEUVD-2022-0032 No score
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
EUVD-2022-0032- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xhp9-4947-rq78
Denial of service in bottle
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
GHSA-xhp9-4947-rq78- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-755
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-31799
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
ALPINE-CVE-2022-31799- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVDEBIAN-CVE-2022-31799
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
DEBIAN-CVE-2022-31799- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 10 moreShow less
OSVGHSA-xhp9-4947-rq78
Denial of service in bottle
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
GHSA-xhp9-4947-rq78- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-755
- Updated
- 2026-11-02
OSVOESA-2022-1712
python-bottle security update
Bottle is a fast, simple and lightweight WSGI micro web-framework for Python. It is distributed as a single file module and has no dependencies other than the Python Standard Library.
Security Fix(es):
Bottle before 0.12.20 mishandles errors during early request binding.(CVE-2022-31799)
- Record
OESA-2022-1712- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-31799
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
UBUNTU-CVE-2022-31799- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV No score
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
CVE-2022-31799- Updated
- 2026-11-02
OSVMGASA-2022-0245 No score
Updated python-bottle packages fix security vulnerability
Bottle before 0.12.20 mishandles errors during early request binding. (CVE-2022-31799)
- Record
MGASA-2022-0245- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13210-1 No score
python-bottle-doc-0.12.25-5.1 on GA media
These are all security issues fixed in the python-bottle-doc-0.12.25-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13210-1- Updated
- 2026-11-02
OSVPYSEC-2022-227 No score
Bottle before 0.12.20 mishandles errors during early request binding.
- Record
PYSEC-2022-227- Updated
- 2026-11-02
OSVSUSE-SU-2022:3103-1 No score
Security update for python-bottle
This update for python-bottle fixes the following issues:
- CVE-2022-31799: Fixed an error mishandling issue that could lead to remote denial of service (bsc#1200286).
- Record
SUSE-SU-2022:3103-1- Updated
- 2026-11-02
OSVUSN-5532-1 No score
python-bottle vulnerability
It was discovered that Bottle incorrectly handled errors during early request binding. An attacker could possibly use this issue to disclose sensitive information. (CVE-2022-31799)
- Record
USN-5532-1- Updated
- 2026-11-02
OSVUSN-5532-2 No score
python-bottle vulnerability
USN-5532-1 fixed a vulnerability in Bottle. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM
Original advisory details:
It was discovered that Bottle incorrectly handled errors during early request binding. An attacker could possibly use this issue to disclose sensitive information. (CVE-2022-31799)
- Record
USN-5532-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bottlePyPI |
before 0.12.20 | 0.12.20 |
py3-bottleAlpine:v3.16 |
before 0.12.21-r0 | 0.12.21-r0 |
py3-bottleAlpine:v3.17 |
before 0.12.21-r0 | 0.12.21-r0 |
py3-bottleAlpine:v3.18 |
before 0.12.21-r0 | 0.12.21-r0 |
py3-bottleAlpine:v3.19 |
before 0.12.21-r0 | 0.12.21-r0 |
py3-bottleAlpine:v3.20 |
before 0.12.21-r0 | 0.12.21-r0 |
py3-bottleAlpine:v3.21 |
before 0.12.21-r0 | 0.12.21-r0 |
py3-bottleAlpine:v3.22 |
before 0.12.21-r0 | 0.12.21-r0 |
py3-bottleAlpine:v3.23 |
before 0.12.21-r0 | 0.12.21-r0 |
py3-bottleAlpine:v3.24 |
before 0.12.21-r0 | 0.12.21-r0 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-bottleDebian:12 |
before 0.12.20-1 | 0.12.20-1 |
python-bottleDebian:13 |
before 0.12.20-1 | 0.12.20-1 |
python-bottleDebian:14 |
before 0.12.20-1 | 0.12.20-1 |
python-bottleDebian:9 |
before 0.12.13-1+deb9u2, plus listed versions 0.12.13-10.12.13-1+deb9u1 |
0.12.13-1+deb9u2 |
python-bottleDebian:10 |
before 0.12.15-2+deb10u2, plus listed versions 0.12.15-20.12.15-2+deb10u1 |
0.12.15-2+deb10u2 |
python-bottleDebian:11 |
before 0.12.19-1+deb11u1, plus listed versions 0.12.19-1 |
0.12.19-1+deb11u1 |
bottlePyPI |
before 0.12.20, plus listed versions 0.10.10.10.100.10.110.10.120.10.2 Show 45 moreShow less0.10.30.10.40.10.50.10.60.10.70.10.80.10.90.11.10.11.20.11.30.11.40.11.50.11.60.11.70.12.10.12.100.12.110.12.120.12.130.12.140.12.150.12.160.12.170.12.180.12.190.12.20.12.30.12.40.12.50.12.60.12.70.12.80.12.90.4.100.4.110.4.120.4.130.4.140.4.30.4.40.4.60.4.70.4.80.4.90.5.3 |
0.12.20 |
python-bottleMageia:8 |
before 0.12.20-1.mga8 | 0.12.20-1.mga8 |
python-bottleopenEuler:20.03-LTS-SP1 |
before 0.12.13-9.oe1 | 0.12.13-9.oe1 |
python-bottleopenEuler:20.03-LTS-SP3 |
before 0.12.13-9.oe1 | 0.12.13-9.oe1 |
python-bottleopenEuler:22.03-LTS |
before 0.12.13-10.oe2203 | 0.12.13-10.oe2203 |
python-bottleSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Module for Python 2 15 SP3 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Server 15-LTSS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Server 15 SP1-BCL |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Server 15 SP2-BCL |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Server for SAP Applications 15 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Manager Proxy 4.1 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Manager Retail Branch Server 4.1 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Manager Server 4.1 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Enterprise Storage 6 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleSUSE:Enterprise Storage 7 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleopenSUSE:Leap 15.3 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleopenSUSE:Leap 15.4 |
before 0.12.13-150000.3.6.1 | 0.12.13-150000.3.6.1 |
python-bottleUbuntu:Pro:14.04:LTS |
before 0.12.0-1ubuntu0.1~esm3, plus listed versions 0.11.6-10.12.0-10.12.0-1ubuntu0.1~esm10.12.0-1ubuntu0.1~esm2 |
0.12.0-1ubuntu0.1~esm3 |
python-bottleUbuntu:Pro:16.04:LTS |
before 0.12.7-1+deb8u1ubuntu0.1~esm1, plus listed versions 0.12.7-10.12.7-1+deb8u1build0.16.04.1 |
0.12.7-1+deb8u1ubuntu0.1~esm1 |
python-bottleUbuntu:18.04:LTS |
before 0.12.13-1ubuntu0.2, plus listed versions 0.12.13-10.12.13-1ubuntu0.1 |
0.12.13-1ubuntu0.2 |
python-bottleUbuntu:20.04:LTS |
before 0.12.15-2.1ubuntu0.2, plus listed versions 0.12.15-20.12.15-2build10.12.15-2.10.12.15-2.1ubuntu0.1 |
0.12.15-2.1ubuntu0.2 |
python-bottleUbuntu:22.04:LTS |
before 0.12.19-1+deb11u1build0.22.04.1, plus listed versions 0.12.19-1 |
0.12.19-1+deb11u1build0.22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31799 is a critical vulnerability (CVSS 9.8) in Bottlepy Bottle, published May 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in bottle 0.12.20.
References
github.com/bottlepy/bottle/commit/e140e1b54da721a660f2eb9d58a106b7b3ff2f00
lists.debian.org/debian-lts-announce/2022/06/msg00010.html
debian.org/security/2022/dsa-5159
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE7U6J45PUEXIYYVWJKPM6QXIRKDK4HD
Show 23 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-31799
security.alpinelinux.org/vuln/CVE-2022-31799
security-tracker.debian.org/tracker/CVE-2022-31799
advisories.mageia.org/MGASA-2022-0245.html
bugs.mageia.org/show_bug.cgi?id=30532
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1712
suse.com/support/update/announcement/2022/suse-su-20223103-1
bugzilla.suse.com/1200286
ubuntu.com/security/CVE-2022-31799
cve.org/CVERecord?id=CVE-2022-31799
Left out here: 24 versions. The JSON record has them.