CVE-2022-45061

Exp

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Published: 2022-11-09 Last update: 2025-11-03 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2022-45061 is rated Exploit Available (51.4/100): CVSS High severity, with low exploitation likelihood (EPSS 0.08%). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2022-45061

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2022-45061

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-11-21 2.41% 0.08% -2.33%
2 2025-11-18 0.08% 2.41% +2.33%
3 2025-03-30 — 0.08% —

Full EPSS history (25 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2022-45061

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 3.6 [email protected]
7.5 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 3.6 134c704f-9b21-4f2e-91b3-4a467353bcc0

Weakness enumeration for CVE-2022-45061

OS Trackers for CVE-2022-45061

vendor priority summary link
alpine — CVE-2022-45061: 1 source package rows (python3); 7 state rows across 7 repos (3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 7, open 0. https://security.alpinelinux.org/vuln/CVE-2022-45061
debian not yet assigned CVE-2022-45061 not yet assigned priority: Debian including 4 source packages (pypy3, python2.7, python3.11, python3.9), 8 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 7, open 1. https://security-tracker.debian.org/tracker/CVE-2022-45061
gentoo high CVE-2022-45061: 1 GLSA(s) (202305-02), 2 atom(s) (dev-lang/python, dev-python/pypy3); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2022-45061
redhat medium — https://access.redhat.com/security/cve/CVE-2022-45061
suse medium CVE-2022-45061 severity moderate: SUSE including 722 source package names (0.0.17-1.1:libpython3_6m1_0-3.6.15-150300.10.40.1, 0.0.17-1.1:python3-3.6.15-150300.10.40.1, …), 2775 product×package rows across 431 product lines (Container bci/bci-base-fips, Container bci/bci-sle15-kernel-module-devel, … (431 product lines)): Fixed 2631, Known Affected 134, Known Not Affected 10. https://www.suse.com/security/cve/CVE-2022-45061/
ubuntu medium CVE-2022-45061 medium priority: Ubuntu including 10 source packages (python, python2.7, …), 88 status rows across 13 suites (bionic, focal, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 56, released 16, needs-triage 9, ignored 4, not-affected 2, needed 1. https://ubuntu.com/security/CVE-2022-45061

Affected software / configurations for CVE-2022-45061

Vendor Product Version Raw CPE
python python <= 3.7.15 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python >= 3.8.0, <= 3.8.15 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python >= 3.9.0, <= 3.9.15 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python >= 3.10.0, <= 3.10.8 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:-:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:beta3:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:beta4:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:beta5:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:rc1:*:*:*:*:*:*
python python 3.11.0 cpe:2.3:a:python:python:3.11.0:rc2:*:*:*:*:*:*
fedoraproject fedora 35 cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
fedoraproject fedora 36 cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
fedoraproject fedora 37 cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
netapp active_iq_unified_manager — cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netapp active_iq_unified_manager — cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
netapp e-series_performance_analyzer — cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*
netapp element_software — cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
netapp hci — cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*
netapp management_services_for_element_software — cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
netapp ontap_select_deploy_administration_utility — cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
netapp bootstrap_os — cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

References for CVE-2022-45061

URL Tags
https://github.com/python/cpython/issues/98433 Exploit Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/
https://security.gentoo.org/glsa/202305-02 Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0007/ Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
cvelogic Threat Intelligence