CVE-2022-40023
mako is vulnerable to Regular Expression Denial of Service
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
CVE-2022-40023- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
CVE List No score
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
CVE-2022-40023- Updated
- 2026-11-02
EUVDEUVD-2022-0149 No score
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
EUVD-2022-0149- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v973-fxgf-6xhp
mako is vulnerable to Regular Expression Denial of Service
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
GHSA-v973-fxgf-6xhp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-40023
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
ALPINE-CVE-2022-40023- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVAZL-10892
CVE-2022-40023 affecting package python-mako for versions less than 1.2.2-1
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
AZL-10892- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 21 moreShow less
OSVBELL-CVE-2022-40023
CVE-2022-40023 does not affect BellSoft software
- Record
BELL-CVE-2022-40023- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-40023
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
DEBIAN-CVE-2022-40023- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVGHSA-v973-fxgf-6xhp
mako is vulnerable to Regular Expression Denial of Service
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
GHSA-v973-fxgf-6xhp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVOESA-2023-1683
python-mako security update
Python-mako is a template library for Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance. Mako's syntax and API borrows from the best ideas of many others, including Django templates, Cheetah, Myghty, and Genshi.
Security Fix(es):
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.(CVE-2022-40023)
- Record
OESA-2023-1683- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:2258
Red Hat Security Advisory: python-mako security update
- Record
RHSA-2023:2258- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:2893
Red Hat Security Advisory: python-mako security update
- Record
RHSA-2023:2893- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2023:2258
Moderate: python-mako security update
Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance.
Security Fix(es):
- python-mako: REDoS in Lexer class (CVE-2022-40023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.2 Release Notes linked from the References section.
- Record
RLSA-2023:2258- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2023:2893
Moderate: python-mako security update
Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance.
Security Fix(es):
- mako: REDoS in Lexer class (CVE-2022-40023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.
- Record
RLSA-2023:2893- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-40023
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
UBUNTU-CVE-2022-40023- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2023:2258 No score
Moderate: python-mako security update
Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance.
Security Fix(es):
- python-mako: REDoS in Lexer class (CVE-2022-40023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2023:2258- Updated
- 2026-11-02
OSVALSA-2023:2893 No score
Moderate: python-mako security update
Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance.
Security Fix(es):
- mako: REDoS in Lexer class (CVE-2022-40023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2023:2893- Updated
- 2026-11-02
OSV No score
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
CVE-2022-40023- Updated
- 2026-11-02
OSVMGASA-2022-0350 No score
Updated python-mako packages fix security vulnerability
Denial of service attack via crafted regular expressions. (CVE-2022-40023)
- Record
MGASA-2022-0350- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13610-1 No score
python310-Mako-1.3.0-2.1 on GA media
These are all security issues fixed in the python310-Mako-1.3.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13610-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11567-1 No score
python313-Mako-1.4.1-1.1 on GA media
These are all security issues fixed in the python313-Mako-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11567-1- Updated
- 2026-11-02
OSVPYSEC-2022-260 No score
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Record
PYSEC-2022-260- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2022-40023 No score
CVE-2022-40023 in rootio-Mako - Patched by Root
Root has patched CVE-2022-40023 in the rootio-Mako package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2022-40023- Updated
- 2026-11-02
OSVSUSE-SU-2022:3700-1 No score
Security update for python-Mako
This update for python-Mako fixes the following issues:
- CVE-2022-40023: Fixed regular expression Denial of Service when using the Lexer class to parse (bsc#1203246).
- Record
SUSE-SU-2022:3700-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3701-1 No score
Security update for python-Mako
This update for python-Mako fixes the following issues:
- CVE-2022-40023: Fixed regular expression Denial of Service when using the Lexer class to parse (bsc#1203246).
- Record
SUSE-SU-2022:3701-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3979-1 No score
Security update for python-Mako
This update for python-Mako fixes the following issues:
- CVE-2022-40023: Fixed regular expression Denial of Service when using the Lexer class to parse (bsc#1203246).
- Record
SUSE-SU-2022:3979-1- Updated
- 2026-11-02
OSVUSN-5625-1 No score
mako vulnerability
It was discovered that Mako incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-5625-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
makoPyPI |
before 1.2.2 | 1.2.2 |
py3-makoAlpine:v3.16 |
before 1.2.2-r0 | 1.2.2-r0 |
py3-makoAlpine:v3.17 |
before 1.2.2-r0 | 1.2.2-r0 |
py3-makoAlpine:v3.18 |
before 1.2.2-r0 | 1.2.2-r0 |
py3-makoAlpine:v3.19 |
before 1.2.2-r0 | 1.2.2-r0 |
py3-makoAlpine:v3.20 |
before 1.2.2-r0 | 1.2.2-r0 |
py3-makoAlpine:v3.21 |
before 1.2.2-r0 | 1.2.2-r0 |
py3-makoAlpine:v3.22 |
before 1.2.2-r0 | 1.2.2-r0 |
py3-makoAlpine:v3.23 |
before 1.2.2-r0 | 1.2.2-r0 |
py3-makoAlpine:v3.24 |
before 1.2.2-r0 | 1.2.2-r0 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3-makoAlmaLinux:9 |
before 1.1.4-6.el9 | 1.1.4-6.el9 |
python3-makoAlmaLinux:8 |
before 1.0.6-14.el8 | 1.0.6-14.el8 |
python-makoAzure Linux:2 |
before 1.2.2-1 | 1.2.2-1 |
makoDebian:12 |
before 1.2.2+ds1-1 | 1.2.2+ds1-1 |
makoDebian:13 |
before 1.2.2+ds1-1 | 1.2.2+ds1-1 |
makoDebian:14 |
before 1.2.2+ds1-1 | 1.2.2+ds1-1 |
makoDebian:10 |
before 1.0.7+ds1-1+deb10u1, plus listed versions 1.0.7+ds1-1 |
1.0.7+ds1-1+deb10u1 |
makoDebian:11 |
before 1.1.3+ds1-2+deb11u1, plus listed versions 1.1.3+ds1-2 |
1.1.3+ds1-2+deb11u1 |
makoPyPI |
before 1.2.2, plus listed versions 0.1.00.1.10.1.100.1.20.1.3 Show 45 moreShow less0.1.40.1.50.1.60.1.70.1.80.1.90.2.00.2.10.2.20.2.30.2.40.2.50.3.00.3.10.3.20.3.30.3.40.3.50.3.60.4.00.4.10.4.20.5.00.6.00.6.10.6.20.7.00.7.10.7.20.7.30.8.00.8.10.9.00.9.11.0.01.0.11.0.101.0.111.0.121.0.131.0.141.0.21.0.31.0.41.0.5 |
1.2.2 |
python-makoMageia:8 |
before 1.2.2-1.mga8 | 1.2.2-1.mga8 |
python-makoopenEuler:20.03-LTS-SP3 |
before 1.0.6-14.oe1 | 1.0.6-14.oe1 |
python-makoRed Hat:enterprise_linux:9::appstream |
before 0:1.1.4-6.el9 | 0:1.1.4-6.el9 |
python3-makoRed Hat:enterprise_linux:9::appstream |
before 0:1.1.4-6.el9 | 0:1.1.4-6.el9 |
python-makoRed Hat:enterprise_linux:8::appstream |
before 0:1.0.6-14.el8 | 0:1.0.6-14.el8 |
python3-makoRed Hat:enterprise_linux:8::appstream |
before 0:1.0.6-14.el8 | 0:1.0.6-14.el8 |
python-makoRocky Linux:9 |
before 0:1.1.4-6.el9 | 0:1.1.4-6.el9 |
python-makoRocky Linux:8 |
before 0:1.0.6-14.el8 | 0:1.0.6-14.el8 |
python-MakoSUSE:OpenStack Cloud 9 |
before 1.0.7-4.3.1 | 1.0.7-4.3.1 |
python-MakoSUSE:OpenStack Cloud Crowbar 9 |
before 1.0.7-4.3.1 | 1.0.7-4.3.1 |
python-MakoSUSE:HPE Helion OpenStack 8 |
before 1.0.7-3.3.1 | 1.0.7-3.3.1 |
python-MakoSUSE:OpenStack Cloud 8 |
before 1.0.7-3.3.1 | 1.0.7-3.3.1 |
python-MakoSUSE:OpenStack Cloud Crowbar 8 |
before 1.0.7-3.3.1 | 1.0.7-3.3.1 |
python-MakoSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 1.0.7-150000.3.3.1 | 1.0.7-150000.3.3.1 |
python-MakoSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 1.0.7-150000.3.3.1 | 1.0.7-150000.3.3.1 |
python-MakoSUSE:Linux Enterprise Module for Package Hub 15 SP3 |
before 1.0.7-150000.3.3.1 | 1.0.7-150000.3.3.1 |
python-MakoSUSE:Linux Enterprise Module for Package Hub 15 SP4 |
before 1.0.7-150000.3.3.1 | 1.0.7-150000.3.3.1 |
python-MakoopenSUSE:Leap 15.3 |
before 1.0.7-150000.3.3.1 | 1.0.7-150000.3.3.1 |
python-MakoopenSUSE:Leap 15.4 |
before 1.0.7-150000.3.3.1 | 1.0.7-150000.3.3.1 |
makoUbuntu:Pro:16.04:LTS |
before 1.0.3+ds1-1ubuntu1+esm1, plus listed versions 1.0.2+ds1-11.0.3+ds1-11.0.3+ds1-1ubuntu1 |
1.0.3+ds1-1ubuntu1+esm1 |
makoUbuntu:18.04:LTS |
before 1.0.7+ds1-1ubuntu0.2, plus listed versions 1.0.7+ds1-1 |
1.0.7+ds1-1ubuntu0.2 |
makoUbuntu:20.04:LTS |
before 1.1.0+ds1-1ubuntu2.1, plus listed versions 1.0.7+ds1-11.1.0+ds1-11.1.0+ds1-1ubuntu11.1.0+ds1-1ubuntu2 |
1.1.0+ds1-1ubuntu2.1 |
makoUbuntu:22.04:LTS |
before 1.1.3+ds1-2ubuntu0.1, plus listed versions 1.1.3+ds1-2 |
1.1.3+ds1-2ubuntu0.1 |
python-MakoopenSUSE:Tumbleweed |
before 1.3.0-2.1 | 1.3.0-2.1 |
python-MakoopenSUSE:Tumbleweed |
before 1.4.1-1.1 | 1.4.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-40023 is a high vulnerability (CVSS 7.5) in Sqlalchemy Mako, published September 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. Fixed in mako 1.2.2.
References
github.com/sqlalchemy/mako/issues/366
pyup.io/vulnerabilities/CVE-2022-40023/50870
lists.debian.org/debian-lts-announce/2022/09/msg00026.html
Show 36 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-40023
security.alpinelinux.org/vuln/CVE-2022-40023
access.redhat.com/errata/RHSA-2023:2258
bugzilla.redhat.com/2128977
errata.almalinux.org/9/ALSA-2023-2258.html
docs.bell-sw.com/security/cves/CVE-2022-40023
security-tracker.debian.org/tracker/CVE-2022-40023
advisories.mageia.org/MGASA-2022-0350.html
bugs.mageia.org/show_bug.cgi?id=30878
ubuntu.com/security/notices/USN-5625-1
debian.org/lts/security/2022/dla-3116
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1683
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2258.json
cve.org/CVERecord?id=CVE-2022-40023
errata.rockylinux.org/RLSA-2023:2258
suse.com/support/update/announcement/2022/suse-su-20223700-1
bugzilla.suse.com/1203246
Left out here: 13 versions. The JSON record has them.