CVE-2022-42966

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
cleo	cleo	< 1.0.0

References

https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/Exploit, Third Party Advisory
https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/Exploit, Third Party Advisory

Timeline

Published: Nov 9, 2022
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-429679.6Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client CVE-2022-429689.8Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.CVE-2022-429697.5The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subv CVE-2022-42979.8The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an CVE-2022-429709.8A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a p CVE-2022-429719.8A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker upl CVE-2022-429727.8A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a loc CVE-2022-429737.8A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to th CVE-2022-429744.8In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting (XSS) a CVE-2022-429757.5socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default beca CVE-2022-429777.5The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and CVE-2022-429787.5In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access