The vulnerability of the Sqlalchemy mako Python template library, related to an incorrect regular expression, allows attackers to cause service interruptions.

🗓️ 10 May 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

SQLAlchemy Mako template library has a regex input validation flaw that allows denial-of-service via crafted data.

Reporter	Title	Published	Views	Family All 114
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Offenses Forwarder App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2023-26159, CVE-2022-40023, CVE-2022-25883)	13 Sep 202418:52	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple vulnerabilties affecting Watson Machine Learning Accelerator on Cloud Pak for Data	12 Dec 202317:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities	20 Jun 202304:41	–	ibm
Tenable Nessus	Amazon Linux 2023 : python3-mako (ALAS2023-2023-288)	14 Aug 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-mako (ALAS-2023-2164)	26 Jul 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0057: python-mako (ALINUX3-SA-2023:0057)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : python-mako (ALSA-2023:2258)	14 May 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : python-mako (ALSA-2023:2893)	21 May 202300:00	–	nessus
Tenable Nessus	CentOS 8 : python-mako (CESA-2023:2893)	16 May 202300:00	–	nessus
Tenable Nessus	CentOS 9 : python-mako-1.1.4-6.el9	29 Feb 202400:00	–	nessus

Vulners

Node

python makoRange<1.2.2

Source	Link
redos	www.redos.red-soft.ru/support/secure/
github	www.github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py
github	www.github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c
github	www.github.com/sqlalchemy/mako/issues/366
lists	www.lists.debian.org/debian-lts-announce/2022/09/msg00026.html
pyup	www.pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
pyup	www.pyup.io/vulnerabilities/CVE-2022-40023/50870/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16

20 Jan 2026 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

CVSS 27.8

EPSS0.01006

Sqlalchemy Mako Python template regex input validation Lexer class denial of service