{"action":"Upgrade lxml to 4.9.1 or later.","affected":[{"fixed":"4.9.1","introduced":"0"}],"component":"lxml","cve_ids":["CVE-2022-2309"],"ecosystem":"PyPI","epss":0.02448,"exploited":false,"fixed_versions":["4.9.1"],"ghsa_id":"GHSA-wrxv-2j5q-m38w","id":"tcs_01M5KG2VSJ8CRNTRS500WSPFHJ","modified_at":"2025-11-04T20:44:22.372909Z","published_at":"2022-07-06T00:00:30Z","references":["https://osv.dev/vulnerability/GHSA-wrxv-2j5q-m38w","https://nvd.nist.gov/vuln/detail/CVE-2022-2309","https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","https://github.com/advisories/GHSA-wrxv-2j5q-m38w","https://github.com/lxml/lxml","https://github.com/lxml/lxml/blob/master/CHANGES.txt","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml","https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","https://security.gentoo.org/glsa/202208-06","https://security.netapp.com/advisory/ntap-20220915-0006"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-wrxv-2j5q-m38w","url":"https://osv.dev/vulnerability/GHSA-wrxv-2j5q-m38w"}],"summary":"lxml NULL Pointer Dereference allows attackers to cause a denial of service"}