ALPINE-CVE-2022-45061

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2022-45061
Published: 09 Nov 2022, 07:15
Last modified:03 Dec 2025, 22:51

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
3.1 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Nov 2022, 07:15
Published
Vulnerability first disclosed
03 Dec 2025, 22:51
Last Modified
Vulnerability information updated

Description

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

  • alpine•python3

    < 3.9.16-r0 | < 3.9.16-r0 | < 3.10.9-r0 | < 3.10.9-r0 | < 3.11.1-r0 | < 3.11.1-r0 | < 3.11.1-r0 | < 3.11.1-r0 | < 3.11.1-r0 | < 3.11.1-r0

References (1)