{"action":"Upgrade setuptools to 65.5.1 or later.","affected":[{"fixed":"65.5.1","introduced":"0"}],"component":"setuptools","cve_ids":["CVE-2022-40897"],"ecosystem":"PyPI","epss":0.02632,"exploited":false,"fixed_versions":["65.5.1"],"ghsa_id":"GHSA-r9hx-vwmv-q579","id":"tcs_01M5KFXMT35NZAVR1AQ4X77EW6","modified_at":"2026-08-07T08:12:25.181519588Z","published_at":"2022-12-23T00:30:23Z","references":["https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579","https://nvd.nist.gov/vuln/detail/CVE-2022-40897","https://github.com/pypa/setuptools/issues/3659","https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be","https://setuptools.pypa.io/en/latest","https://security.netapp.com/advisory/ntap-20240621-0006","https://security.netapp.com/advisory/ntap-20230214-0001","https://pyup.io/vulnerabilities/CVE-2022-40897/52495","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R","https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html","https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1","https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200","https://github.com/pypa/setuptools","https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2022-43012.yaml"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-r9hx-vwmv-q579","url":"https://osv.dev/vulnerability/GHSA-r9hx-vwmv-q579"}],"summary":"pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)"}