{"action":"Upgrade future to 0.18.3 or later.","affected":[{"fixed":"0.18.3","introduced":"0"}],"component":"future","cve_ids":["CVE-2022-40899"],"ecosystem":"PyPI","epss":0.01941,"exploited":false,"fixed_versions":["0.18.3"],"ghsa_id":"GHSA-v3c5-jqr6-7qm8","id":"tcs_01M5KGHA3HB5RZC9461815SHT4","modified_at":"2026-06-10T17:01:17.773881552Z","published_at":"2022-12-23T00:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-42991","https://pypi.org/project/future/","https://github.com/python/cpython/pull/17157","https://github.com/PythonCharmers/python-future/blob/master/src/future/backports/http/cookiejar.py#L215","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/","https://github.com/PythonCharmers/python-future/pull/610","https://github.com/advisories/GHSA-v3c5-jqr6-7qm8"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-42991","url":"https://osv.dev/vulnerability/PYSEC-2022-42991"}],"summary":"An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server."}