mako is vulnerable to Regular Expression Denial of Service
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-40023US | high7.5 | — | ||
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-v973-fxgf-6xhpADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2022-260.yamlWEB
- https://github.com/sqlalchemy/makoWEB
- https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21WEB
- https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068cWEB
- https://github.com/sqlalchemy/mako/issues/366WEB
- https://lists.debian.org/debian-lts-announce/2022/09/msg00026.htmlWEB
- https://lists.debian.org/debian-lts-announce/2025/12/msg00004.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan