CVE-2022-39280

    Dashboard / Vulnerabilities / CVE-2022-39280

    CVE-2022-39280

    Published: 6 Oct 2022Last Modified: 12 Aug 2026

    Summary: Regular expression denial of service in dparse

    Details: dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.

    References: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39280.json, https://github.com/pyupio/dparse/security/advisories/GHSA-8fg9-p83m-x5pq, https://nvd.nist.gov/vuln/detail/CVE-2022-39280, https://github.com/pyupio/dparse/commit/8c990170bbd6c0cf212f1151e9025486556062d5, https://github.com/pyupio/dparse/commit/d87364f9db9ab916451b1b036cfeb039e726e614

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a3d9beb0f97331bdc0cb83ec628131e89b8c68d2

    Affected versions

    0.5.1
    0.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39280 | CVE-DB