{"id":"CVE-2022-40023","aliases":["ALPINE-CVE-2022-40023","ALSA-2023:2258","ALSA-2023:2893","AZL-10892","BELL-CVE-2022-40023","DEBIAN-CVE-2022-40023","DLA-3116-1","DLA-4393-1","EUVD-2022-0149","GHSA-v973-fxgf-6xhp","MGASA-2022-0350","OESA-2023-1683","PYSEC-2022-260","RHSA-2023:2258","RHSA-2023:2893","RLSA-2023:2258","RLSA-2023:2893","ROOT-APP-PYPI-CVE-2022-40023","SUSE-SU-2022:3700-1","SUSE-SU-2022:3701-1","SUSE-SU-2022:3979-1","UBUNTU-CVE-2022-40023","USN-5625-1","openSUSE-SU-2024:13610-1","openSUSE-SU-2026:11567-1"],"status":"published","title":"mako is vulnerable to Regular Expression Denial of Service","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0232,"percentile":0.83574,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2022-09-07T00:00:00Z","modified":"2026-10-29T11:30:52Z","fixes":[{"ecosystem":"PyPI","package":"mako","fixed_in":["1.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-mako","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-mako","fixed_in":["1.1.4-6.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"python3-mako","fixed_in":["1.0.6-14.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-mako","fixed_in":["1.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mako","fixed_in":["1.2.2+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mako","fixed_in":["1.2.2+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mako","fixed_in":["1.2.2+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"mako","fixed_in":["1.0.7+ds1-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"mako","fixed_in":["1.1.3+ds1-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-mako","fixed_in":["1.2.2-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-mako","fixed_in":["1.0.6-14.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-mako","fixed_in":["0:1.1.4-6.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-mako","fixed_in":["0:1.1.4-6.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-mako","fixed_in":["0:1.0.6-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-mako","fixed_in":["0:1.0.6-14.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"python-mako","fixed_in":["0:1.1.4-6.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"python-mako","fixed_in":["0:1.0.6-14.el8"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Mako","fixed_in":["1.0.7-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Mako","fixed_in":["1.0.7-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Mako","fixed_in":["1.0.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Mako","fixed_in":["1.0.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Mako","fixed_in":["1.0.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-Mako","fixed_in":["1.0.7-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-Mako","fixed_in":["1.0.7-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-Mako","fixed_in":["1.0.7-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"python-Mako","fixed_in":["1.0.7-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-Mako","fixed_in":["1.0.7-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-Mako","fixed_in":["1.0.7-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mako","fixed_in":["1.0.3+ds1-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"mako","fixed_in":["1.0.7+ds1-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"mako","fixed_in":["1.1.0+ds1-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"mako","fixed_in":["1.1.3+ds1-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Mako","fixed_in":["1.3.0-2.1","1.4.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-6.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-14.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7+ds1-1+deb10u1"}]}],"versions":["1.0.7+ds1-1"]},{"source":"osv","ecosystem":"Debian:11","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+ds1-2+deb11u1"}]}],"versions":["1.1.3+ds1-2"]},{"source":"osv","ecosystem":"PyPI","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.9.0","0.9.1","1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-14.oe1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mako","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"925760291d6efec64fda6e9dd1fd9cfbd5be068c"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.9.0","0.9.1","1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-6.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-6.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-6.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-14.el8"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3+ds1-1ubuntu1+esm1"}]}],"versions":["1.0.2+ds1-1","1.0.3+ds1-1","1.0.3+ds1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7+ds1-1ubuntu0.2"}]}],"versions":["1.0.7+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+ds1-1ubuntu2.1"}]}],"versions":["1.0.7+ds1-1","1.1.0+ds1-1","1.1.0+ds1-1ubuntu1","1.1.0+ds1-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+ds1-2ubuntu0.1"}]}],"versions":["1.1.3+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3+ds1-1ubuntu1+esm1"}]}],"versions":["1.0.2+ds1-1","1.0.3+ds1-1","1.0.3+ds1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7+ds1-1ubuntu0.2"}]}],"versions":["1.0.7+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+ds1-1ubuntu2.1"}]}],"versions":["1.0.7+ds1-1","1.1.0+ds1-1","1.1.0+ds1-1ubuntu1","1.1.0+ds1-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+ds1-2ubuntu0.1"}]}],"versions":["1.1.3+ds1-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Mako","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"sqlalchemy","product":"mako"}],"references":[{"url":"https://github.com/sqlalchemy/mako/issues/366","tags":["x_transferred","Issue Tracking","Patch","report","web"]},{"url":"https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://pyup.io/vulnerabilities/CVE-2022-40023/50870/","tags":["x_transferred","Third Party Advisory","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/12/msg00004.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40023","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2022-260.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v973-fxgf-6xhp","tags":["advisory"]},{"url":"https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages","tags":["web"]},{"url":"https://pyup.io/vulnerabilities/CVE-2022-40023/50870","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-40023","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2258","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40023","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128977","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2258.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2893","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-2893.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-40023","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40023.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-40023","tags":["advisory"]},{"url":"https://github.com/sqlalchemy/mako","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0350.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30878","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5625-1","tags":["advisory"]},{"url":"https://www.debian.org/lts/security/2022/dla-3116","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1683","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128977","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2258.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40023","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2893.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2258","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2893","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223700-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203246","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40023","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223701-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223979-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-40023","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5625-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-40023","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T00:00:00Z","modified":"2025-12-03T06:05:04.544Z","updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-0149","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T00:00:00Z","modified":"2025-12-03T06:05:04Z","updated_at":"2026-11-02T19:49:10.716009Z"}],"ghsa":[{"id":"GHSA-v973-fxgf-6xhp","title":"mako is vulnerable to Regular Expression Denial of Service","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-16T17:20:25Z","modified":"2025-12-03T15:11:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:39:11.110487Z"}],"nvd":[{"id":"CVE-2022-40023","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T13:15:09.953Z","modified":"2026-06-17T05:00:47.023Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"ALPINE-CVE-2022-40023","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T13:15:09.953Z","modified":"2026-11-03T07:18:33.689376715Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-10892","title":"CVE-2022-40023 affecting package python-mako for versions less than 1.2.2-1","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T13:15:09Z","modified":"2026-04-21T04:21:37.284004Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"BELL-CVE-2022-40023","title":"CVE-2022-40023 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:35.495644Z","modified":"2026-01-26T09:49:40.35754Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"DEBIAN-CVE-2022-40023","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T13:15:09.953Z","modified":"2026-11-03T08:03:05.589786325Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-v973-fxgf-6xhp","title":"mako is vulnerable to Regular Expression Denial of Service","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-16T17:20:25Z","modified":"2025-12-03T15:46:59.399133Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"OESA-2023-1683","title":"python-mako security update","description":"Python-mako is a template library for Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance. Mako\u0026apos;s syntax and API borrows from the best ideas of many others, including Django templates, Cheetah, Myghty, and Genshi.\r\n\r\nSecurity Fix(es):\r\n\r\nSqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.(CVE-2022-40023)","status":"published","published":"2023-09-28T11:06:08Z","modified":"2026-08-18T01:17:05.192999043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2023:2258","title":"Red Hat Security Advisory: python-mako security update","status":"published","published":"2024-09-14T01:39:12Z","modified":"2026-06-29T10:47:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2893","title":"Red Hat Security Advisory: python-mako security update","status":"published","published":"2024-09-14T01:39:43Z","modified":"2026-06-29T10:47:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RLSA-2023:2258","title":"Moderate: python-mako security update","description":"Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance.\n\nSecurity Fix(es):\n\n* python-mako: REDoS in Lexer class (CVE-2022-40023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.2 Release Notes linked from the References section.","status":"published","published":"2025-12-03T09:05:37.576021Z","modified":"2025-12-03T11:33:55.086425Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:2893","title":"Moderate: python-mako security update","description":"Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance.\n\nSecurity Fix(es):\n\n* mako: REDoS in Lexer class (CVE-2022-40023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.","status":"published","published":"2025-12-03T09:02:28.353442Z","modified":"2025-12-03T11:33:55.508907Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-40023","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T13:15:00Z","modified":"2026-02-05T06:14:30.963371Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"ALSA-2023:2258","title":"Moderate: python-mako security update","description":"Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance.\n\nSecurity Fix(es):\n\n* python-mako: REDoS in Lexer class (CVE-2022-40023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:52.69630397Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2893","title":"Moderate: python-mako security update","description":"Mako is a template library written in Python. It provides a familiar, non-XML syntax which compiles into Python modules for maximum performance.\n\nSecurity Fix(es):\n\n* mako: REDoS in Lexer class (CVE-2022-40023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:13.828832738Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CVE-2022-40023","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T00:00:00Z","modified":"2026-10-28T02:30:28.588479681Z","updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DLA-3116-1","title":"mako - security update","status":"published","published":"2022-09-21T00:00:00Z","modified":"2026-03-09T01:21:47.188028Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-4393-1","title":"mako - security update","status":"published","published":"2025-12-03T00:00:00Z","modified":"2025-12-03T05:33:35.86032Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2022-0350","title":"Updated python-mako packages fix security vulnerability","description":"Denial of service attack via crafted regular expressions. (CVE-2022-40023)\n","status":"published","published":"2022-10-01T17:48:24Z","modified":"2026-04-16T04:41:29.444337865Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13610-1","title":"python310-Mako-1.3.0-2.1 on GA media","description":"These are all security issues fixed in the python310-Mako-1.3.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:25.074554Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11567-1","title":"python313-Mako-1.4.1-1.1 on GA media","description":"These are all security issues fixed in the python313-Mako-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-21T00:00:00Z","modified":"2026-08-22T18:23:35.824219677Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2022-260","description":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.","status":"published","published":"2022-09-07T13:15:00Z","modified":"2023-11-08T04:10:22.118239Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"ROOT-APP-PYPI-CVE-2022-40023","title":"CVE-2022-40023 in rootio-Mako - Patched by Root","description":"Root has patched CVE-2022-40023 in the rootio-Mako package for Root:PyPI. Multiple fixed versions available.","status":"withdrawn","published":"2025-11-28T10:33:22Z","modified":"2026-09-06T14:00:03.919755717Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"SUSE-SU-2022:3700-1","title":"Security update for python-Mako","description":"This update for python-Mako fixes the following issues:\n\n  - CVE-2022-40023: Fixed regular expression Denial of Service when using the Lexer class to parse (bsc#1203246).\n\n","status":"published","published":"2022-10-24T11:55:22Z","modified":"2026-02-04T02:48:39.309286Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3701-1","title":"Security update for python-Mako","description":"This update for python-Mako fixes the following issues:\n\n  - CVE-2022-40023: Fixed regular expression Denial of Service when using the Lexer class to parse (bsc#1203246).\n\n","status":"published","published":"2022-10-24T11:55:37Z","modified":"2026-02-04T02:39:30.023974Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3979-1","title":"Security update for python-Mako","description":"This update for python-Mako fixes the following issues:\n\n  - CVE-2022-40023: Fixed regular expression Denial of Service when using the Lexer class to parse (bsc#1203246).\n\n","status":"published","published":"2022-11-15T10:06:04Z","modified":"2026-02-04T03:08:11.726972Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5625-1","title":"mako vulnerability","description":"It was discovered that Mako incorrectly handled certain regular expressions.\nAn attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2022-09-21T10:39:16Z","modified":"2026-06-25T13:31:23.945776258Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}