{"action":"Upgrade apache-airflow to 2.4.0b1 or later.","affected":[{"fixed":"2.4.0b1","introduced":"2.3.0"}],"component":"apache-airflow","cve_ids":["CVE-2022-40604"],"ecosystem":"PyPI","epss":0.02083,"exploited":false,"fixed_versions":["2.4.0b1"],"ghsa_id":"GHSA-5rp4-749p-vx26","id":"tcs_01M5KGGYRWSB1GJ9MBFXH90C6Y","modified_at":"2026-06-10T17:00:08.828936483Z","published_at":"2022-09-21T08:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-279","https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t","https://github.com/apache/airflow/pull/26337","https://github.com/advisories/GHSA-5rp4-749p-vx26"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-279","url":"https://osv.dev/vulnerability/PYSEC-2022-279"}],"summary":"In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction."}