{"id":"CVE-2022-40898","aliases":["ALSA-2023:6712","AZL-12098","DEBIAN-CVE-2022-40898","EUVD-2022-0364","GHSA-qwmp-2cf2-g9g6","MGASA-2023-0218","OESA-2023-1904","PYSEC-2022-43017","RHSA-2023:6712","RHSA-2023:6793","RHSA-2024:10761","RLSA-2023:6712","ROOT-APP-PYPI-CVE-2022-40898","SUSE-SU-2023:0088-1","SUSE-SU-2023:0088-2","SUSE-SU-2023:0089-1","UBUNTU-CVE-2022-40898","USN-5821-1","USN-5821-2","USN-5821-3","openSUSE-SU-2024:12645-1","openSUSE-SU-2024:13214-1"],"status":"published","title":"pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02837,"percentile":0.86826,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-20"],"published":"2022-12-22T00:00:00Z","modified":"2026-11-03T08:03:55Z","fixes":[{"ecosystem":"PyPI","package":"wheel","fixed_in":["0.38.1"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-wheel","fixed_in":["1:0.36.2-8.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-wheel-wheel","fixed_in":["1:0.36.2-8.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-wheel","fixed_in":["0.33.6-8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wheel","fixed_in":["0.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wheel","fixed_in":["0.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wheel","fixed_in":["0.38.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-wheel","fixed_in":["0.35.1-2.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-wheel","fixed_in":["0.31.1-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-wheel","fixed_in":["0.31.1-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-wheel","fixed_in":["0.37.0-6.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-wheel","fixed_in":["0.37.0-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"python-wheel","fixed_in":["0.37.0-6.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python-wheel","fixed_in":["1:0.36.2-8.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-wheel","fixed_in":["1:0.36.2-8.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-wheel-wheel","fixed_in":["1:0.36.2-8.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"python-wheel","fixed_in":["1:0.36.2-8.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-wheel","fixed_in":["0.32.3-150100.6.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-wheel","fixed_in":["0.30.0-2.7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","fixed_in":["1.5.4-1ubuntu4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wheel","fixed_in":["0.24.0-1~ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","fixed_in":["8.1.1-2ubuntu0.6+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wheel","fixed_in":["0.29.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-pip","fixed_in":["9.0.1-2.3~ubuntu1.18.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"wheel","fixed_in":["0.30.0-0.2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-pip","fixed_in":["20.0.2-5ubuntu1.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"wheel","fixed_in":["0.34.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-pip","fixed_in":["22.0.2+dfsg-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"wheel","fixed_in":["0.37.1-2ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-ciscoconfparse","fixed_in":["1.7.7-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.36.2-8.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-wheel-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.36.2-8.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.33.6-8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.1"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.10.3","0.11.0","0.12.0","0.13.0","0.14.0","0.15.0","0.16.0","0.17.0","0.18.0","0.19.0","0.2","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.28.0","0.29.0","0.3","0.30.0","0.30.0a0","0.31.0","0.31.1","0.32.0","0.32.1","0.32.2","0.32.3","0.33.0","0.33.1","0.33.4","0.33.5","0.33.6","0.34.0","0.34.1","0.34.2","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.37.0","0.37.1","0.38.0","0.4","0.4.1","0.4.2","0.5","0.6","0.7","0.8","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.35.1-2.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.0-6.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.0-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.0-6.oe2203sp2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.1"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.10.3","0.11.0","0.12.0","0.13.0","0.14.0","0.15.0","0.16.0","0.17.0","0.18.0","0.19.0","0.2","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.28.0","0.29.0","0.3","0.30.0","0.30.0a0","0.31.0","0.31.1","0.32.0","0.32.1","0.32.2","0.32.3","0.33.0","0.33.1","0.33.4","0.33.5","0.33.6","0.34.0","0.34.1","0.34.2","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.37.0","0.37.1","0.38.0","0.4","0.4.1","0.4.2","0.5","0.6","0.7","0.8","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.36.2-8.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.36.2-8.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-wheel-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.36.2-8.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:19.3.1-4.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-pip-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:19.3.1-4.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-srpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.18-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:41.6.0-8.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-setuptools-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:41.6.0-8.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.33.6-9.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-wheel-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.33.6-9.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8-6.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8-6.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-python38-python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.22.0-11.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rhc-worker-playbook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.10-1.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rhc-worker-playbook-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.10-1.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.36.2-8.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.3-150100.6.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0-2.7.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1ubuntu4+esm3"}]}],"versions":["1.4.1-2","1.5.4-1","1.5.4-1ubuntu1","1.5.4-1ubuntu3","1.5.4-1ubuntu4","1.5.4-1ubuntu4+esm1","1.5.4-1ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.0-1~ubuntu1.1+esm1"}]}],"versions":["0.24.0-1~ubuntu1","0.24.0-1~ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-2ubuntu0.6+esm4"}]}],"versions":["1.5.6-7ubuntu1","1.5.6-7ubuntu2","8.0.2-7","8.0.3-1","8.0.3-2","8.1.0-1","8.1.0-2","8.1.1-1","8.1.1-2","8.1.1-2ubuntu0.1","8.1.1-2ubuntu0.2","8.1.1-2ubuntu0.4","8.1.1-2ubuntu0.6","8.1.1-2ubuntu0.6+esm2","8.1.1-2ubuntu0.6+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0-1ubuntu0.1~esm1"}]}],"versions":["0.26.0-1","0.29.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-2.3~ubuntu1.18.04.7"}]}],"versions":["9.0.1-2","9.0.1-2.3~ubuntu1","9.0.1-2.3~ubuntu1.18.04.1","9.0.1-2.3~ubuntu1.18.04.2","9.0.1-2.3~ubuntu1.18.04.3","9.0.1-2.3~ubuntu1.18.04.4","9.0.1-2.3~ubuntu1.18.04.5","9.0.1-2.3~ubuntu1.18.04.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0-0.2ubuntu0.1"}]}],"versions":["0.29.0-2","0.30.0-0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.2-5ubuntu1.8"}]}],"versions":["18.1-5","18.1-5build1","18.1-5ubuntu1","20.0.2-2","20.0.2-4","20.0.2-5","20.0.2-5ubuntu1","20.0.2-5ubuntu1.1","20.0.2-5ubuntu1.3","20.0.2-5ubuntu1.4","20.0.2-5ubuntu1.5","20.0.2-5ubuntu1.6","20.0.2-5ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.2-1ubuntu0.1"}]}],"versions":["0.32.3-2","0.33.6-1","0.33.6-1ubuntu1","0.33.6-2","0.34.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.2+dfsg-1ubuntu0.2"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.1-2ubuntu0.22.04.1"}]}],"versions":["0.34.2-1","0.37.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.0-1~ubuntu1.1+esm1"}]}],"versions":["0.24.0-1~ubuntu1","0.24.0-1~ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0-0.2ubuntu0.1"}]}],"versions":["0.29.0-2","0.30.0-0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.2-1ubuntu0.1"}]}],"versions":["0.32.3-2","0.33.6-1","0.33.6-1ubuntu1","0.33.6-2","0.34.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.1-2ubuntu0.22.04.1"}]}],"versions":["0.34.2-1","0.37.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0-1ubuntu0.1~esm1"}]}],"versions":["0.26.0-1","0.29.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1ubuntu4+esm3"}]}],"versions":["1.4.1-2","1.5.4-1","1.5.4-1ubuntu1","1.5.4-1ubuntu3","1.5.4-1ubuntu4","1.5.4-1ubuntu4+esm1","1.5.4-1ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-2ubuntu0.6+esm4"}]}],"versions":["1.5.6-7ubuntu1","1.5.6-7ubuntu2","8.0.2-7","8.0.3-1","8.0.3-2","8.1.0-1","8.1.0-2","8.1.1-1","8.1.1-2","8.1.1-2ubuntu0.1","8.1.1-2ubuntu0.2","8.1.1-2ubuntu0.4","8.1.1-2ubuntu0.6","8.1.1-2ubuntu0.6+esm2","8.1.1-2ubuntu0.6+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-2.3~ubuntu1.18.04.7"}]}],"versions":["9.0.1-2","9.0.1-2.3~ubuntu1","9.0.1-2.3~ubuntu1.18.04.1","9.0.1-2.3~ubuntu1.18.04.2","9.0.1-2.3~ubuntu1.18.04.3","9.0.1-2.3~ubuntu1.18.04.4","9.0.1-2.3~ubuntu1.18.04.5","9.0.1-2.3~ubuntu1.18.04.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.2-5ubuntu1.8"}]}],"versions":["18.1-5","18.1-5build1","18.1-5ubuntu1","20.0.2-2","20.0.2-4","20.0.2-5","20.0.2-5ubuntu1","20.0.2-5ubuntu1.1","20.0.2-5ubuntu1.3","20.0.2-5ubuntu1.4","20.0.2-5ubuntu1.5","20.0.2-5ubuntu1.6","20.0.2-5ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.2+dfsg-1ubuntu0.2"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-ciscoconfparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-1.1"}]}]}],"products":[{"vendor":"wheel_project","product":"wheel"}],"references":[{"url":"https://pypi.org/project/wheel/","tags":["x_transferred","Product","Third Party Advisory","package","report"]},{"url":"https://github.com/pypa/wheel/blob/main/src/wheel/wheelfile.py#L18","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/","tags":["x_transferred","Exploit","Vendor Advisory","web","evidence","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40898","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/wheel/PYSEC-2022-43017.yaml","tags":["web"]},{"url":"https://pypi.org/project/wheel","tags":["web"]},{"url":"https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages","tags":["web"]},{"url":"https://pyup.io/vulnerabilities/CVE-2022-40898/51499","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qwmp-2cf2-g9g6","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6712","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40898","tags":["report"]},{"url":"https://bugzilla.redhat.com/2165864","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6712.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40898.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-40898","tags":["advisory"]},{"url":"https://github.com/pypa/wheel","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0218.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31420","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4M566AB324K3L6V4C2RMDKBBBJ7LYVV/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5821-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1904","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165864","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6712.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40898","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6793","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=263261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2144072","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171817","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235789","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6793.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-4559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-4559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40897","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40897","tags":["advisory"]},{"url":"https://pyup.io/vulnerabilities/CVE-2022-40897/52495/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45061","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45061","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45061","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/98433","tags":["article"]},{"url":"https://python-security.readthedocs.io/vuln/slow-idna-large-strings.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23931","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","tags":["advisory"]},{"url":"https://pointernull.com/security/python-url-parse-problem.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32681","tags":["advisory"]},{"url":"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40217","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40217","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40217","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/108310","tags":["article"]},{"url":"https://github.com/python/cpython/pull/108315","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/PEPLII27KYHLF4AK3ZQGKYNCRERG4YXY/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10761","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230890","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10761.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1428","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1428","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1428","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32731","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32731","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32731","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cfgp-2977-2fmm","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-33953","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-33953","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33953","tags":["advisory"]},{"url":"https://cloud.google.com/support/bulletins#gcp-2023-022","tags":["article"]},{"url":"https://github.com/advisories/GHSA-496j-2rq6-j6cc","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:6712","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230088-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206670","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40898","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230088-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230089-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-40898","tags":["report"]},{"url":"https://github.com/pypa/wheel/commit/88f02bc335d5404991e532e7f3b0fc80437bf4e0","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5821-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5821-3","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-40898","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-15T15:53:50.771Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-0364","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2025-04-15T15:53:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:28.317823Z"}],"ghsa":[{"id":"GHSA-qwmp-2cf2-g9g6","title":"pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)","description":"Python Packaging Authority (PyPA) Wheel is a reference implementation of the Python wheel packaging standard. Wheel 0.37.1 and earlier are vulnerable to a Regular Expression denial of service via attacker controlled input to the wheel cli. The vulnerable regex is used to verify the validity of Wheel file names. This has been patched in version 0.38.1.","status":"published","published":"2022-12-23T00:30:23Z","modified":"2024-11-19T19:04:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:38:21.777721Z"}],"nvd":[{"id":"CVE-2022-40898","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","status":"published","published":"2022-12-23T00:15:14.043Z","modified":"2026-06-17T05:02:13.177Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"AZL-12098","title":"CVE-2022-40898 affecting package python-wheel for versions less than 0.33.6-8","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","status":"published","published":"2022-12-23T00:15:14Z","modified":"2026-04-21T04:22:25.032471Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"CVE-2022-40898","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","status":"published","published":"2022-12-22T00:00:00Z","modified":"2026-10-28T02:30:36.788722228Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DEBIAN-CVE-2022-40898","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","status":"published","published":"2022-12-23T00:15:14.043Z","modified":"2026-11-03T08:03:55.131541002Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"GHSA-qwmp-2cf2-g9g6","title":"pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)","description":"Python Packaging Authority (PyPA) Wheel is a reference implementation of the Python wheel packaging standard. Wheel 0.37.1 and earlier are vulnerable to a Regular Expression denial of service via attacker controlled input to the wheel cli. The vulnerable regex is used to verify the validity of Wheel file names. This has been patched in version 0.38.1.","status":"published","published":"2022-12-23T00:30:23Z","modified":"2024-11-19T19:22:35.244591Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"OESA-2023-1904","title":"python-wheel security update","description":"A built-package format for Python. A wheel is a ZIP-format archive with a specially formatted filename and the .whl extension. It is designed to contain all the files for a PEP 376 compatible install in a way that is very close to the on-disk format.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.(CVE-2022-40898)","status":"published","published":"2023-12-15T11:06:21Z","modified":"2026-08-18T01:18:05.37157799Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2023:6712","title":"Red Hat Security Advisory: python-wheel security update","status":"published","published":"2024-09-13T21:16:10Z","modified":"2026-06-28T11:02:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:6793","title":"Red Hat Security Advisory: rh-python38-python security update","status":"published","published":"2024-09-23T16:54:48Z","modified":"2026-08-20T10:05:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:10761","title":"Red Hat Security Advisory: rhc-worker-playbook security update","status":"published","published":"2024-12-04T10:02:18Z","modified":"2026-10-09T10:09:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RLSA-2023:6712","title":"Moderate: python-wheel security update","description":"Wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427.\n\nSecurity Fix(es):\n\n* python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli (CVE-2022-40898)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.3 Release Notes linked from the References section.","status":"published","published":"2026-06-26T18:03:19.195576Z","modified":"2026-06-26T18:24:15.395486108Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-40898","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","status":"published","published":"2022-12-23T00:15:00Z","modified":"2026-02-04T03:43:52.838428Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"ALSA-2023:6712","title":"Moderate: python-wheel security update","description":"Wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427.\n\nSecurity Fix(es):\n\n* python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli (CVE-2022-40898)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:35.396299818Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"MGASA-2023-0218","title":"Updated python-wheel packages fix security vulnerability","description":"Denial of service via attacker controlled input to wheel cli\n(CVE-2022-40898)\n","status":"published","published":"2023-07-07T05:54:45Z","modified":"2026-04-16T04:40:38.464632432Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12645-1","title":"python310-ciscoconfparse-1.7.7-1.1 on GA media","description":"These are all security issues fixed in the python310-ciscoconfparse-1.7.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:22.061473Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:13214-1","title":"python310-wheel-0.41.2-2.1 on GA media","description":"These are all security issues fixed in the python310-wheel-0.41.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:30:58.565716Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"PYSEC-2022-43017","description":"An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.","status":"published","published":"2022-12-23T00:15:00Z","modified":"2026-06-10T17:02:50.204495025Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"ROOT-APP-PYPI-CVE-2022-40898","title":"CVE-2022-40898 in rootio-wheel - Patched by Root","description":"Root has patched CVE-2022-40898 in the rootio-wheel package for Root:PyPI. Multiple fixed versions available.","status":"withdrawn","published":"2025-12-05T12:04:55Z","modified":"2026-09-06T14:00:05.001431824Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"SUSE-SU-2023:0088-1","title":"Security update for python-wheel","description":"This update for python-wheel fixes the following issues:\n\n- CVE-2022-40898: Fixed an excessive use of CPU that could be triggered\n  via a crafted regular expression (bsc#1206670).\n","status":"published","published":"2023-01-16T09:31:11Z","modified":"2026-02-04T04:27:41.385437Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0088-2","title":"Security update for python-wheel","description":"This update for python-wheel fixes the following issues:\n\n- CVE-2022-40898: Fixed an excessive use of CPU that could be triggered\n  via a crafted regular expression (bsc#1206670).\n","status":"published","published":"2023-03-09T07:03:36Z","modified":"2026-02-04T04:20:44.881671Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0089-1","title":"Security update for python-wheel","description":"This update for python-wheel fixes the following issues:\n\n- CVE-2022-40898: Fixed an excessive use of CPU that could be triggered\n  via a crafted regular expression (bsc#1206670).\n","status":"published","published":"2023-01-16T09:31:21Z","modified":"2026-02-04T03:35:17.36137Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5821-1","title":"wheel vulnerability","description":"Sebastian Chnelik discovered that wheel incorrectly handled\ncertain file names when validated against a regex expression.\nAn attacker could possibly use this issue to cause a\ndenial of service.\n","status":"published","published":"2023-01-24T09:21:51Z","modified":"2026-06-29T13:50:45.35643713Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-5821-2","title":"wheel vulnerability","description":"USN-5821-1 fixed a vulnerability in wheel. This update provides\nthe corresponding update for Ubuntu 16.04 ESM.\nOriginal advisory details:\n\n Sebastian Chnelik discovered that wheel incorrectly handled\n certain file names when validated against a regex expression.\n An attacker could possibly use this issue to cause a\n denial of service.\n","status":"published","published":"2023-01-24T14:31:28Z","modified":"2026-06-25T13:31:42.918239615Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-5821-3","title":"python-pip regression","description":"USN-5821-1 fixed a vulnerability in wheel and pip. Unfortunately,\nit was missing a commit to fix it properly in pip.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Sebastian Chnelik discovered that wheel incorrectly handled\n certain file names when validated against a regex expression.\n An attacker could possibly use this issue to cause a\n denial of service.\n","status":"published","published":"2023-02-28T14:07:36Z","modified":"2026-06-29T13:50:45.321922787Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}