LiveActive security incident?Get immediate response
CVE Record

CVE-2022-40023: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer cla...

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-40023 is a denial-of-service risk in Mako before 1.2.2. A crafted input processed by the Lexer parser can trigger excessive regular expression work, potentially slowing or tying up affected processes. Business urgency depends on whether Mako parsing handles untrusted content in production or build pipelines.

Executive priority

Prioritize remediation for internet-facing services or shared platforms that parse externally supplied templates or localization content. For internal-only build tooling with trusted inputs, handle through normal patch cycles, but do not ignore dependency drift.

Technical view

The issue is a Regular Expression Denial of Service in sqlalchemy/mako before 1.2.2 when the Lexer class parses input. The source bundle also names babelplugin and linguaplugin as affected paths. No CVSS or CWE details are provided, so impact must be assessed from usage context.

Likely exposure

Exposure is most likely in Python applications, localization extraction, or template-processing workflows using Mako versions before 1.2.2, especially where parsing can be influenced by users, tenants, files, or external content.

Exploitation context

The bundle does not show CISA KEV listing or any cited evidence of active exploitation. Public issue, commit, advisory, and Debian security update references indicate the flaw and fix were publicly known in 2022.

Researcher notes

Evidence is sufficient for affected component and fixed-version direction, but incomplete for CVSS, CWE, exploit prevalence, and exact affected plugin versions. Avoid assuming remote exploitability without confirming how parsing is exposed in the application.

Mitigation direction

  • Inventory Python dependencies for Mako versions before 1.2.2.
  • Upgrade Mako to 1.2.2 or later where supported.
  • Apply Debian security updates for packaged Mako installations.
  • Limit Mako Lexer parsing to trusted input where upgrades are pending.
  • Check vendor guidance for babelplugin and linguaplugin usage.

Validation and detection

  • Confirm deployed dependency manifests resolve Mako 1.2.2 or later.
  • Review SBOMs and lockfiles for transitive Mako dependencies.
  • Identify code paths using Mako Lexer, babelplugin, or linguaplugin.
  • Check whether parsed content can originate from untrusted users or external files.
  • Verify patched Debian package versions on managed hosts.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-40023 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.