{"action":"Upgrade mako to 1.2.2 or later.","affected":[{"fixed":"1.2.2","introduced":"0"}],"component":"mako","cve_ids":["CVE-2022-40023"],"ecosystem":"PyPI","epss":0.02174,"exploited":false,"fixed_versions":["1.2.2"],"ghsa_id":"GHSA-v973-fxgf-6xhp","id":"tcs_01M5KFZQFJVHYQ7KADTG7ZXR2X","modified_at":"2025-12-03T15:46:59.399133Z","published_at":"2022-09-16T17:20:25Z","references":["https://osv.dev/vulnerability/GHSA-v973-fxgf-6xhp","https://nvd.nist.gov/vuln/detail/CVE-2022-40023","https://github.com/sqlalchemy/mako/issues/366","https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c","https://github.com/advisories/GHSA-v973-fxgf-6xhp","https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2022-260.yaml","https://github.com/sqlalchemy/mako","https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21","https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html","https://lists.debian.org/debian-lts-announce/2025/12/msg00004.html","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages","https://pyup.io/vulnerabilities/CVE-2022-40023/50870"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-v973-fxgf-6xhp","url":"https://osv.dev/vulnerability/GHSA-v973-fxgf-6xhp"}],"summary":"mako is vulnerable to Regular Expression Denial of Service"}