An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00109.

Exploitation poc

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

OR cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:-:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:beta3:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:beta4:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:beta5:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:rc1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.11.0:rc2:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
python3-0:3.6.8-48.el8_7.1 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:0833 2023-02-21T00:00:00Z
python38:3.8-8080020221221151857.0d9ba776 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:2763 2023-05-16T00:00:00Z
python38-devel:3.8-8080020221221151857.0d9ba776 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:2763 2023-05-16T00:00:00Z
python39:3.9-8080020221221152015.aed85c85 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:2764 2023-05-16T00:00:00Z
python39-devel:3.9-8080020221221152015.aed85c85 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:2764 2023-05-16T00:00:00Z
python27:2.7-8080020221221225124.ba5e661a cpe:/a:redhat:enterprise_linux:8 RHSA-2023:2860 2023-05-16T00:00:00Z
python3-0:3.6.8-48.el8_7.1 cpe:/o:redhat:enterprise_linux:8 RHSA-2023:0833 2023-02-21T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
python3-0:3.6.8-47.el8_6.4 cpe:/a:redhat:rhel_eus:8.6 RHSA-2024:0430 2024-01-25T00:00:00Z
Red Hat Enterprise Linux 9
python3.9-0:3.9.14-1.el9_1.2 cpe:/a:redhat:enterprise_linux:9 RHSA-2023:0953 2023-02-28T00:00:00Z
python3.9-0:3.9.14-1.el9_1.2 cpe:/o:redhat:enterprise_linux:9 RHSA-2023:0953 2023-02-28T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-python38-python-0:3.8.18-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2023:6793 2023-11-08T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Fedoraproject Subscribe
Fedora Subscribe
Netapp Subscribe
Active Iq Unified Manager Subscribe
Bootstrap Os Subscribe
E-series Performance Analyzer Subscribe
Element Software Subscribe
Hci Subscribe
Hci Compute Node Subscribe
Management Services For Element Software Subscribe
Ontap Select Deploy Administration Utility Subscribe
Python Subscribe
Python Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Rhel Eus Subscribe
Rhel Software Collections Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-3432-1 python2.7 security update
Debian DLA Debian DLA DLA-3477-1 python3.7 security update
Debian DLA Debian DLA DLA-3966-1 pypy3 security update
Debian DLA Debian DLA DLA-3980-1 python3.9 security update
EUVD EUVD EUVD-2022-47983 An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
Ubuntu USN Ubuntu USN USN-5767-1 Python vulnerabilities
Ubuntu USN Ubuntu USN USN-5767-2 Python vulnerability
Ubuntu USN Ubuntu USN USN-5888-1 Python vulnerabilities
Ubuntu USN Ubuntu USN USN-6891-1 Python vulnerabilities
Ubuntu USN Ubuntu USN USN-7212-1 Python 2.7 vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/python/cpython/issues/98433 cve-icon cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html cve-icon
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-45061 cve-icon
https://python-security.readthedocs.io/vuln/slow-idna-large-strings.html cve-icon
https://security.gentoo.org/glsa/202305-02 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20221209-0007/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-45061 cve-icon
History

Mon, 03 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.0008}

 epss

{'score': 0.00082}

Thu, 01 May 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-11-03T21:46:44.155Z

Reserved: 2022-11-09T00:00:00.000Z

Link: CVE-2022-45061

cve-icon Vulnrichment

Updated: 2025-11-03T21:46:44.155Z

cve-icon NVD

Status : Modified

Published: 2022-11-09T07:15:09.887

Modified: 2025-11-03T22:16:01.150

Link: CVE-2022-45061

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-11-09T00:00:00Z

Links: CVE-2022-45061 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses