{"action":"Upgrade setuptools to 65.5.1 or later.","affected":[{"fixed":"65.5.1","introduced":"0"}],"component":"setuptools","cve_ids":["CVE-2022-40897"],"ecosystem":"PyPI","epss":0.02632,"exploited":false,"fixed_versions":["65.5.1"],"ghsa_id":"GHSA-r9hx-vwmv-q579","id":"tcs_01M5KGHDRBVT02M080WV8T2HE0","modified_at":"2026-06-10T17:02:40.148961359Z","published_at":"2022-12-23T00:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43012","https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200","https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/","https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1","https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be","https://pyup.io/vulnerabilities/CVE-2022-40897/52495/","https://github.com/advisories/GHSA-r9hx-vwmv-q579"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-43012","url":"https://osv.dev/vulnerability/PYSEC-2022-43012"}],"summary":"Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression"}