Moderate severityNVD Advisory· Published Nov 9, 2022· Updated May 1, 2025
Exponential ReDoS in cleo leads to denial of service
CVE-2022-42966
Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
cleoPyPI | < 2.0.0 | 2.0.0 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-2p9h-ccw7-33gfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-42966ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/cleo/PYSEC-2022-43178.yamlghsaWEB
- github.com/python-poetry/cleo/commit/b5b9a04d2caf58bf7cf94eb7ae4a1ebbe60ea455ghsaWEB
- github.com/python-poetry/cleo/pull/285ghsaWEB
- github.com/python-poetry/cleo/releases/tag/2.0.0ghsaWEB
- research.jfrog.com/vulnerabilities/cleo-redos-xray-257186ghsaWEB
- research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/mitre
News mentions
0No linked articles in our index yet.