CVE-2022-45061: fedoraproject fedora Inefficient Algorithmic Complexity

Modified

AliasesALPINE-CVE-2022-45061SUSE-SU-2022:4258-1SUSE-SU-2022:4275-1+13 more

Published 09-11-2022Last modified 14-10-2026

Vulnerability summary

CVE-2022-45061 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in fedoraproject fedora. EPSS estimates a 2.67% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

2.67%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

09-11-2022
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.5

EPSS trend

Probability

2.67%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 2.65% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Cpython
Maturity: poc

Weaknesses

CWE · root cause

CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat131 products

babel< 0:2.5.1-10.module+el8.5.0+11014+88fc0d0b
Cython< 0:0.28.1-7.module+el8.1.0+3111+de3f2d8e
Cython-debugsource< 0:0.28.1-7.module+el8.1.0+3111+de3f2d8e
numpy< 1:1.14.2-16.module+el8.4.0+9406+221a4565
numpy-debugsource< 1:1.14.2-16.module+el8.4.0+9406+221a4565

pytest< 0:3.4.2-13.module+el8.1.0+3111+de3f2d8e
python-attrs< 0:17.4.0-10.module+el8.1.0+3111+de3f2d8e
python-backports< 0:1.0-16.module+el8.4.0+9193+f3daf6ef
python-backports-ssl_match_hostname< 0:3.5.0.1-12.module+el8.4.0+9193+f3daf6ef
python-chardet< 0:3.0.4-10.module+el8.1.0+3111+de3f2d8e
python-coverage< 0:4.5.1-4.module+el8.1.0+3111+de3f2d8e
python-coverage-debugsource< 0:4.5.1-4.module+el8.1.0+3111+de3f2d8e
python-dns< 0:1.15.0-10.module+el8.1.0+3111+de3f2d8e
python-docs< 0:2.7.16-2.module+el8.1.0+3111+de3f2d8e
python-docutils< 0:0.14-12.module+el8.1.0+3111+de3f2d8e
python-funcsigs< 0:1.0.2-13.module+el8.1.0+3111+de3f2d8e
python-idna< 0:2.5-7.module+el8.1.0+3111+de3f2d8e
python-ipaddress< 0:1.0.18-6.module+el8.1.0+3111+de3f2d8e
python-jinja2< 0:2.10-9.module+el8.5.0+10541+706bb066
python-lxml< 0:4.2.3-6.module+el8.6.0+13959+8e368262
python-lxml-debugsource< 0:4.2.3-6.module+el8.6.0+13959+8e368262
python-markupsafe< 0:0.23-19.module+el8.1.0+3111+de3f2d8e
python-mock< 0:2.0.0-13.module+el8.1.0+3111+de3f2d8e
python-nose< 0:1.3.7-31.module+el8.5.0+12203+77770ab7
python-nose-docs< 0:1.3.7-31.module+el8.5.0+12203+77770ab7
python-pluggy< 0:0.6.0-8.module+el8.1.0+3111+de3f2d8e
python-psycopg2< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python-psycopg2-debuginfo< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python-psycopg2-debugsource< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python-psycopg2-doc< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python-py< 0:1.5.3-6.module+el8.1.0+3111+de3f2d8e
python-pygments< 0:2.2.0-22.module+el8.5.0+10788+a4cea9e0
python-pymongo< 0:3.7.0-1.module+el8.5.0+10264+e5753a40
python-pymongo-debuginfo< 0:3.7.0-1.module+el8.5.0+10264+e5753a40
python-pymongo-debugsource< 0:3.7.0-1.module+el8.5.0+10264+e5753a40
python-PyMySQL< 0:0.8.0-10.module+el8.1.0+3111+de3f2d8e
python-pysocks< 0:1.6.8-6.module+el8.1.0+3111+de3f2d8e
python-pytest-mock< 0:1.9.0-4.module+el8.1.0+3111+de3f2d8e
python-requests< 0:2.20.0-3.module+el8.2.0+4577+feefd9b8
python-setuptools_scm< 0:1.15.7-6.module+el8.1.0+3111+de3f2d8e
python-sqlalchemy< 0:1.3.2-2.module+el8.3.0+6647+8d010749
python-sqlalchemy-doc< 0:1.3.2-2.module+el8.3.0+6647+8d010749
python-unversioned-command< 0:3.9.14-1.el9_1.2
python-urllib3< 0:1.24.2-3.module+el8.4.0+9193+f3daf6ef
python-virtualenv< 0:15.1.0-21.module+el8.5.0+12203+77770ab7
python-wheel< 1:0.31.1-3.module+el8.5.0+12203+77770ab7
python2< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-attrs< 0:17.4.0-10.module+el8.1.0+3111+de3f2d8e
python2-babel< 0:2.5.1-10.module+el8.5.0+11014+88fc0d0b
python2-backports< 0:1.0-16.module+el8.4.0+9193+f3daf6ef
python2-backports-ssl_match_hostname< 0:3.5.0.1-12.module+el8.4.0+9193+f3daf6ef
python2-bson< 0:3.7.0-1.module+el8.5.0+10264+e5753a40
python2-bson-debuginfo< 0:3.7.0-1.module+el8.5.0+10264+e5753a40
python2-chardet< 0:3.0.4-10.module+el8.1.0+3111+de3f2d8e
python2-coverage< 0:4.5.1-4.module+el8.1.0+3111+de3f2d8e
python2-coverage-debuginfo< 0:4.5.1-4.module+el8.1.0+3111+de3f2d8e
python2-Cython< 0:0.28.1-7.module+el8.1.0+3111+de3f2d8e
python2-Cython-debuginfo< 0:0.28.1-7.module+el8.1.0+3111+de3f2d8e
python2-debug< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-debuginfo< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-debugsource< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-devel< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-dns< 0:1.15.0-10.module+el8.1.0+3111+de3f2d8e
python2-docs< 0:2.7.16-2.module+el8.1.0+3111+de3f2d8e
python2-docs-info< 0:2.7.16-2.module+el8.1.0+3111+de3f2d8e
python2-docutils< 0:0.14-12.module+el8.1.0+3111+de3f2d8e
python2-funcsigs< 0:1.0.2-13.module+el8.1.0+3111+de3f2d8e
python2-idna< 0:2.5-7.module+el8.1.0+3111+de3f2d8e
python2-ipaddress< 0:1.0.18-6.module+el8.1.0+3111+de3f2d8e
python2-jinja2< 0:2.10-9.module+el8.5.0+10541+706bb066
python2-libs< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-lxml< 0:4.2.3-6.module+el8.6.0+13959+8e368262
python2-lxml-debuginfo< 0:4.2.3-6.module+el8.6.0+13959+8e368262
python2-markupsafe< 0:0.23-19.module+el8.1.0+3111+de3f2d8e
python2-mock< 0:2.0.0-13.module+el8.1.0+3111+de3f2d8e
python2-nose< 0:1.3.7-31.module+el8.5.0+12203+77770ab7
python2-numpy< 1:1.14.2-16.module+el8.4.0+9406+221a4565
python2-numpy-debuginfo< 1:1.14.2-16.module+el8.4.0+9406+221a4565
python2-numpy-doc< 1:1.14.2-16.module+el8.4.0+9406+221a4565
python2-numpy-f2py< 1:1.14.2-16.module+el8.4.0+9406+221a4565
python2-pip< 0:9.0.3-19.module+el8.6.0+13001+ad200bd9
python2-pip-wheel< 0:9.0.3-19.module+el8.6.0+13001+ad200bd9
python2-pluggy< 0:0.6.0-8.module+el8.1.0+3111+de3f2d8e
python2-psycopg2< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python2-psycopg2-debug< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python2-psycopg2-debug-debuginfo< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python2-psycopg2-debuginfo< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python2-psycopg2-tests< 0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
python2-py< 0:1.5.3-6.module+el8.1.0+3111+de3f2d8e
python2-pygments< 0:2.2.0-22.module+el8.5.0+10788+a4cea9e0
python2-pymongo< 0:3.7.0-1.module+el8.5.0+10264+e5753a40
python2-pymongo-debuginfo< 0:3.7.0-1.module+el8.5.0+10264+e5753a40
python2-pymongo-gridfs< 0:3.7.0-1.module+el8.5.0+10264+e5753a40
python2-PyMySQL< 0:0.8.0-10.module+el8.1.0+3111+de3f2d8e
python2-pysocks< 0:1.6.8-6.module+el8.1.0+3111+de3f2d8e
python2-pytest< 0:3.4.2-13.module+el8.1.0+3111+de3f2d8e
python2-pytest-mock< 0:1.9.0-4.module+el8.1.0+3111+de3f2d8e
python2-pytz< 0:2017.2-12.module+el8.1.0+3111+de3f2d8e
python2-pyyaml< 0:3.12-16.module+el8.1.0+3111+de3f2d8e
python2-pyyaml-debuginfo< 0:3.12-16.module+el8.1.0+3111+de3f2d8e
python2-requests< 0:2.20.0-3.module+el8.2.0+4577+feefd9b8
python2-rpm-macros< 0:3-38.module+el8.1.0+3111+de3f2d8e
python2-scipy< 0:1.0.0-21.module+el8.5.0+10858+05337455
python2-scipy-debuginfo< 0:1.0.0-21.module+el8.5.0+10858+05337455
python2-setuptools< 0:39.0.1-13.module+el8.4.0+9442+27d0e81c
python2-setuptools_scm< 0:1.15.7-6.module+el8.1.0+3111+de3f2d8e
python2-setuptools-wheel< 0:39.0.1-13.module+el8.4.0+9442+27d0e81c
python2-six< 0:1.11.0-6.module+el8.4.0+9287+299307c7
python2-sqlalchemy< 0:1.3.2-2.module+el8.3.0+6647+8d010749
python2-test< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-tkinter< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-tools< 0:2.7.18-12.module+el8.8.0+17629+2cfc9d03
python2-urllib3< 0:1.24.2-3.module+el8.4.0+9193+f3daf6ef
python2-virtualenv< 0:15.1.0-21.module+el8.5.0+12203+77770ab7
python2-wheel< 1:0.31.1-3.module+el8.5.0+12203+77770ab7
python2-wheel-wheel< 1:0.31.1-3.module+el8.5.0+12203+77770ab7
python3< 0:3.9.14-1.el9_1.2
python3-debug< 0:3.9.14-1.el9_1.2
python3-devel< 0:3.9.14-1.el9_1.2
python3-idle< 0:3.9.14-1.el9_1.2
python3-libs< 0:3.9.14-1.el9_1.2
python3-test< 0:3.9.14-1.el9_1.2
python3-tkinter< 0:3.9.14-1.el9_1.2
python39< 0:3.9.14-1.el9_1.2
python39-debuginfo< 0:3.9.14-1.el9_1.2
python39-debugsource< 0:3.9.14-1.el9_1.2
pytz< 0:2017.2-12.module+el8.1.0+3111+de3f2d8e
PyYAML< 0:3.12-16.module+el8.1.0+3111+de3f2d8e
PyYAML-debugsource< 0:3.12-16.module+el8.1.0+3111+de3f2d8e
scipy< 0:1.0.0-21.module+el8.5.0+10858+05337455
scipy-debugsource< 0:1.0.0-21.module+el8.5.0+10858+05337455

Show all 131

Suse38 products

python-base&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 2.7.18-28.93.1
python-base&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 2.7.18-33.17.1
python-base&distro=SUSE Linux Enterprise Server 12 SP5< 2.7.18-33.17.1
python-base&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 2.7.18-33.17.1
python-base&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.7.18-33.17.1

python-base&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 2.7.18-33.17.1
python-base&distro=SUSE OpenStack Cloud 9< 2.7.18-33.17.1
python-base&distro=SUSE OpenStack Cloud Crowbar 9< 2.7.18-33.17.1
python-doc&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 2.7.18-28.93.1
python-doc&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 2.7.18-33.17.1
python-doc&distro=SUSE Linux Enterprise Server 12 SP5< 2.7.18-33.17.1
python-doc&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 2.7.18-33.17.1
python-doc&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.7.18-33.17.1
python-doc&distro=SUSE OpenStack Cloud 9< 2.7.18-33.17.1
python-doc&distro=SUSE OpenStack Cloud Crowbar 9< 2.7.18-33.17.1
python3-core&distro=SUSE Enterprise Storage 6< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Enterprise Storage 7< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Micro 5.1< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Micro 5.2< 3.6.15-150300.10.40.1
python3-core&distro=SUSE Linux Enterprise Micro 5.3< 3.6.15-150300.10.40.1
python3-core&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 3.6.15-150300.10.40.1
python3-core&distro=SUSE Linux Enterprise Module for Development Tools 15 SP4< 3.6.15-150300.10.40.1
python3-core&distro=SUSE Linux Enterprise Real Time 15 SP3< 3.6.15-150300.10.40.1
python3-core&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Server 15 SP2-BCL< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Server 15 SP2-LTSS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Server 15-LTSS< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Server for SAP Applications 15< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2< 3.6.15-150000.3.119.1
python3-core&distro=SUSE Manager Proxy 4.1< 3.6.15-150000.3.119.1

Show all 38

Opensuse10 products

python3-core&distro=openSUSE Leap 15.4< 3.6.15-150300.10.40.1
python3-core&distro=openSUSE Leap Micro 5.3< 3.6.15-150300.10.40.1
python3-documentation&distro=openSUSE Leap 15.4< 3.6.15-150300.10.40.1
python310&distro=openSUSE Tumbleweed< 3.10.8-3.1
python311&distro=openSUSE Tumbleweed< 3.11.0-2.1

Show all 10

Ubuntu9 products

python2.7< 2.7.17-1~18.04ubuntu1.10 | < 2.7.18-1~20.04.7+esm4 | < 2.7.18-13ubuntu1.5+esm3 | < 2.7.6-8ubuntu0.6+esm13 | < 2.7.12-1ubuntu0~16.04.18+esm3
python3.10< 3.10.6-1~22.04.2
python3.11< 3.11.0~rc1-1~22.04.1~esm1
python3.4All versions (No fix recorded)
python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.13+esm6

Show all 9

Netapp7 products

Show all 7

Debian2 products

pypy3< 7.3.11+dfsg-1
python3.11< 3.11.1-1

Alpine1 product

python3< 3.9.16-r0 | < 3.10.9-r0 | < 3.11.1-r0

Fedoraproject1 product

fedoraEOL35 | 36 | 37

Python1 product

python≤ 3.7.15 | ≥ 3.8.0, ≤ 3.8.15 | ≥ 3.9.0, ≤ 3.9.15 | ≥ 3.10.0, ≤ 3.10.8 | 3.11.0 | 3.11.0:alpha1 | 3.11.0:alpha2 | 3.11.0:alpha3 | 3.11.0:alpha4 | 3.11.0:alpha5 | 3.11.0:alpha6 | 3.11.0:alpha7 | 3.11.0:beta1 | 3.11.0:beta2 | 3.11.0:beta3 | 3.11.0:beta4 | 3.11.0:beta5 | 3.11.0:rc1 | 3.11.0:rc2

9 vendors · 200 products · Showing 200 of 238