VYPR
← All advisories
High severityNVD Advisory· Published Dec 9, 2020· Updated Nov 3, 2025

CVE-2020-29651

CVE-2020-29651

Description

A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A ReDoS vulnerability in py.path.svnwc of python-py allows attackers to cause a denial of service via crafted input to the blame functionality.

Vulnerability

Overview CVE-2020-29651 is a regular expression denial of service (ReDoS) vulnerability in the py.path.svnwc component of the Python py library up to version 1.9.0. The issue arises from a poorly crafted regular expression that can lead to catastrophic backtracking when processing specially crafted input [1][2].

Exploitation

An attacker can exploit this vulnerability by providing malicious input to the blame functionality of py.path.svnwc. No authentication is required, and the attack can be carried out remotely if the application exposes the vulnerable function to user-supplied data. The attack complexity is low, as the input can be crafted without special privileges [2].

Impact

Successful exploitation results in a denial of service condition, where the affected system consumes excessive CPU resources, potentially causing the application to become unresponsive. This can lead to service disruption for legitimate users [1][2].

Mitigation

The vulnerability has been fixed in py version 1.9.1. Users should upgrade to the latest version to mitigate the risk. The advisory is tracked in the PyPA advisory database [3].

References
  1. NVD - CVE-2020-29651
  2. CVE-2020-29651 - GitHub Advisory Database
  3. advisory-database/vulns/py/PYSEC-2020-92.yaml at main · pypa/advisory-database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pyPyPI
< 1.10.01.10.0

Affected products

203

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.