{"id":"CVE-2022-42964","aliases":["DEBIAN-CVE-2022-42964","EUVD-2022-7243","GHSA-5jqp-885w-xj32","PYSEC-2026-909","UBUNTU-CVE-2022-42964"],"status":"published","title":"Exponential ReDoS in pymatgen leads to denial of service","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00956,"percentile":0.61664,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2022-11-09T00:00:00Z","modified":"2026-10-27T17:00:05Z","fixes":[{"ecosystem":"Debian:12","package":"pymatgen","fixed_in":["2022.11.7+dfsg1-11+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pymatgen","fixed_in":["2023.06.23+dfsg1-1"],"sources":["osv"]},{"ecosystem":"PyPI","package":"pymatgen","fixed_in":["2025.10.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2022.9.21"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.11.7+dfsg1-11+deb12u2"}]}],"versions":["2022.11.7+dfsg1-11","2022.11.7+dfsg1-11+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.06.23+dfsg1-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2022.9.21"}]}],"versions":["1.0.4","1.0.5","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.8","1.2.9","1.5.0","1.6.0","1.7.0","1.7.2","1.8.0","1.8.2","1.8.3","1.9.0","2.0.0","2.1.0","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.6","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.7.0","2.7.1","2.7.2b","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.14","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2017.10.16","2017.11.27","2017.11.30","2017.11.6","2017.11.9","2017.12.15","2017.12.16","2017.12.30","2017.12.6","2017.12.8","2017.6.22","2017.6.24","2017.6.8","2017.7.21","2017.7.4","2017.8.14","2017.8.16","2017.8.20","2017.8.21","2017.8.4","2017.9.1","2017.9.23","2017.9.3","2018.1.19","2018.1.29","2018.10.18","2018.11.30","2018.11.6","2018.12.12","2018.2.13","2018.3.13","2018.3.14","2018.3.2","2018.3.23","2018.4.20","2018.4.6","2018.5.14","2018.5.21","2018.5.22","2018.5.3","2018.6.11","2018.6.27","2018.7.15","2018.7.23","2018.8.10","2018.8.7","2018.9.1","2018.9.12","2018.9.19","2018.9.30","2019.1.13","2019.1.24","2019.10.16","2019.10.2","2019.10.3","2019.10.4","2019.11.11","2019.12.22","2019.12.3","2019.2.24","2019.2.28","2019.2.4","2019.3.13","2019.3.27","2019.4.11","2019.5.1","2019.5.28","2019.5.8","2019.6.20","2019.6.5","2019.7.2","2019.7.21","2019.7.30","2019.8.14","2019.8.23","2019.9.12","2019.9.16","2019.9.7","2019.9.8","2020.1.10","2020.1.28","2020.10.20","2020.10.9","2020.10.9.1","2020.11.11","2020.12.18","2020.12.3","2020.12.31","2020.3.13","2020.3.2","2020.4.2","2020.4.29","2020.6.8","2020.7.10","2020.7.14","2020.7.16","2020.7.18","2020.7.3","2020.8.13","2020.8.3","2020.9.14","2021.2.13","2021.2.14","2021.2.16","2021.2.8","2021.2.8.1","2021.3.3","2021.3.4","2021.3.5","2021.3.9","2022.0.0","2022.0.1","2022.0.10","2022.0.11","2022.0.12","2022.0.13","2022.0.14","2022.0.15","2022.0.16","2022.0.17","2022.0.2","2022.0.3","2022.0.4","2022.0.5","2022.0.6","2022.0.7","2022.0.8","2022.0.9","2022.1.20","2022.1.24","2022.1.8","2022.1.9","2022.2.1","2022.2.10","2022.2.7","2022.3.22","2022.3.24","2022.3.29","2022.3.7","2022.4.19","2022.4.26","2022.5.17","2022.5.18","2022.5.18.1","2022.5.19","2022.5.26","2022.7.19","2022.7.24","2022.7.24.1","2022.7.25","2022.7.8","2022.8.23","2022.9.21","2022.9.8","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.5.0","3.5.1","3.5.2","3.5.3","3.6.0","3.6.1","3.7.0","3.7.1","4.0.0","4.0.1","4.0.2","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3.0","4.3.1","4.3.2","4.4.0","4.4.1","4.4.10","4.4.11","4.4.12","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.6.0","4.6.1","4.6.2","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7"]},{"source":"osv","ecosystem":"PyPI","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10.7"}]}],"versions":["1.0.4","1.0.5","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.8","1.2.9","1.5.0","1.6.0","1.7.0","1.7.2","1.8.0","1.8.2","1.8.3","1.9.0","2.0.0","2.1.0","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.6","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.7.0","2.7.1","2.7.2b","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.14","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2017.10.16","2017.11.27","2017.11.30","2017.11.6","2017.11.9","2017.12.15","2017.12.16","2017.12.30","2017.12.6","2017.12.8","2017.6.22","2017.6.24","2017.6.8","2017.7.21","2017.7.4","2017.8.14","2017.8.16","2017.8.20","2017.8.21","2017.8.4","2017.9.1","2017.9.23","2017.9.3","2018.1.19","2018.1.29","2018.10.18","2018.11.30","2018.11.6","2018.12.12","2018.2.13","2018.3.13","2018.3.14","2018.3.2","2018.3.23","2018.4.20","2018.4.6","2018.5.14","2018.5.21","2018.5.22","2018.5.3","2018.6.11","2018.6.27","2018.7.15","2018.7.23","2018.8.10","2018.8.7","2018.9.1","2018.9.12","2018.9.19","2018.9.30","2019.1.13","2019.1.24","2019.10.16","2019.10.2","2019.10.3","2019.10.4","2019.11.11","2019.12.22","2019.12.3","2019.2.24","2019.2.28","2019.2.4","2019.3.13","2019.3.27","2019.4.11","2019.5.1","2019.5.28","2019.5.8","2019.6.20","2019.6.5","2019.7.2","2019.7.21","2019.7.30","2019.8.14","2019.8.23","2019.9.12","2019.9.16","2019.9.7","2019.9.8","2020.1.10","2020.1.28","2020.10.20","2020.10.9","2020.10.9.1","2020.11.11","2020.12.18","2020.12.3","2020.12.31","2020.3.13","2020.3.2","2020.4.2","2020.4.29","2020.6.8","2020.7.10","2020.7.14","2020.7.16","2020.7.18","2020.7.3","2020.8.13","2020.8.3","2020.9.14","2021.2.13","2021.2.14","2021.2.16","2021.2.8","2021.2.8.1","2021.3.3","2021.3.4","2021.3.5","2021.3.9","2022.0.0","2022.0.1","2022.0.10","2022.0.11","2022.0.12","2022.0.13","2022.0.14","2022.0.15","2022.0.16","2022.0.17","2022.0.2","2022.0.3","2022.0.4","2022.0.5","2022.0.6","2022.0.7","2022.0.8","2022.0.9","2022.1.20","2022.1.24","2022.1.8","2022.1.9","2022.10.22","2022.11.1","2022.11.7","2022.2.1","2022.2.10","2022.2.7","2022.3.22","2022.3.24","2022.3.29","2022.3.7","2022.4.19","2022.4.26","2022.5.17","2022.5.18","2022.5.18.1","2022.5.19","2022.5.26","2022.7.19","2022.7.24","2022.7.24.1","2022.7.25","2022.7.8","2022.8.23","2022.9.21","2022.9.8","2023.1.20","2023.1.30","2023.1.9","2023.10.11","2023.10.3","2023.10.4","2023.11.10","2023.11.12","2023.12.18","2023.2.22","2023.2.28","2023.3.10","2023.3.23","2023.5.10","2023.5.31","2023.5.8","2023.6.23","2023.6.28","2023.7.11","2023.7.14","2023.7.17","2023.7.20","2023.8.10","2023.9.10","2023.9.2","2023.9.25","2024.1.26","2024.1.27","2024.10.22","2024.10.25","2024.10.27","2024.10.29","2024.10.3","2024.11.13","2024.2.20","2024.2.23","2024.2.8","2024.3.1","2024.4.12","2024.4.13","2024.5.1","2024.5.31","2024.6.10","2024.6.4","2024.7.18","2024.8.8","2024.8.9","2024.9.10","2024.9.17","2024.9.17.1","2025.1.23","2025.1.24","2025.1.9","2025.2.18","2025.3.10","2025.4.10","2025.4.16","2025.4.17","2025.4.19","2025.4.20","2025.4.24","2025.5.1","2025.5.2","2025.5.28","2025.6.14","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.5.0","3.5.1","3.5.2","3.5.3","3.6.0","3.6.1","3.7.0","3.7.1","4.0.0","4.0.1","4.0.2","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3.0","4.3.1","4.3.2","4.4.0","4.4.1","4.4.10","4.4.11","4.4.12","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.6.0","4.6.1","4.6.2","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.0.14+dfsg1-1","2022.0.16+dfsg1-1","2022.0.17+dfsg1-1","2022.0.17+dfsg1-1build1"]}],"products":[{"vendor":"materialsproject","product":"pymatgen"},{"vendor":"materialsvirtuallab","product":"pymatgen"},{"vendor":"pymatgen","product":"pymatgen"}],"references":[{"url":"https://research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184/","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42964","tags":["advisory"]},{"url":"https://github.com/materialsproject/pymatgen/issues/2755","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5jqp-885w-xj32","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-42964","tags":["advisory"]},{"url":"https://github.com/materialsproject/pymatgen","tags":["package"]},{"url":"https://research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184","tags":["web"]},{"url":"https://pypi.org/project/pymatgen","tags":["package"]},{"url":"https://github.com/materialsproject/pymatgen/pull/4476","tags":["fix"]},{"url":"https://github.com/materialsproject/pymatgen/commit/8d2ca2296109f9e5a4ac1c751eee650ab4303108","tags":["fix"]},{"url":"https://ubuntu.com/security/CVE-2022-42964","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42964","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-42964","title":"Exponential ReDoS in pymatgen leads to denial of service","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method","status":"published","published":"2022-11-09T00:00:00Z","modified":"2025-05-01T19:19:37.705Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-7243","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method","status":"published","published":"2022-11-09T00:00:00Z","modified":"2025-05-01T19:19:37Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:51:56.360543Z"}],"ghsa":[{"id":"GHSA-5jqp-885w-xj32","title":"pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the `GaussianInput.from_string` method.","status":"published","published":"2022-11-10T12:01:17Z","modified":"2023-08-31T00:33:19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2022-42964","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method","status":"published","published":"2022-11-09T20:15:09.793Z","modified":"2026-06-17T05:05:40.777Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"CVE-2022-42964","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method","status":"published","published":"2022-11-09T20:15:09.793Z","modified":"2026-07-07T11:56:39.677240055Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"DEBIAN-CVE-2022-42964","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method","status":"published","published":"2022-11-09T20:15:09.793Z","modified":"2026-11-03T08:03:41.027499089Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:24.826312Z"},{"id":"GHSA-5jqp-885w-xj32","title":"pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the `GaussianInput.from_string` method.","status":"published","published":"2022-11-10T12:01:17Z","modified":"2026-07-07T11:56:39.677240055Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"PYSEC-2026-909","title":"pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the `GaussianInput.from_string` method.","status":"published","published":"2026-07-07T10:17:23.427661Z","modified":"2026-07-08T12:00:09.987680129Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2022-42964","description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method","status":"published","published":"2022-11-09T20:15:00Z","modified":"2025-09-08T16:50:29Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"}]}}