CVE-2022-40023

Published: Sep 7, 2022

Modified: Dec 3, 2025

PUBLISHED

Description

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/sqlalchemy/mako/issues/366

https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c

https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21

https://pyup.io/vulnerabilities/CVE-2022-40023/50870/

[debian-lts-announce] 20220921 [SECURITY] [DLA 3116-1] mako security update

mailing-list

https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2022-40023

Description

Affected Products

References