The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.

🗓️ 02 Oct 2025 06:11:25Reported by MicrosoftType

Python library up to version 1.11.0 permits remote ReDoS via crafted Subversion info data due to mishandled InfoSvnCommand.

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: Vulnerability in pytest-dev py affects IBM watsonx.data	25 Sep 202418:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	16 Apr 202521:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities	20 Jun 202304:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in py library affects IBM Cloud Pak for Data System 1.0(CPDS 1.0) [CVE-2022-42969]	4 Apr 202305:59	–	ibm
FreeBSD	py39-py -- Regular expression Denial of Service vulnerability	4 Nov 202200:00	–	freebsd
CBLMariner	CVE-2022-42969 affecting package python-py 1.10.0-3	12 Jan 202509:15	–	cbl_mariner
CBLMariner	CVE-2022-42969 affecting package python-py 1.10.0-1	12 Jan 202509:15	–	cbl_mariner
Circl	CVE-2022-42969	16 Oct 202212:30	–	circl
CNNVD	Pytest 安全漏洞	16 Oct 202200:00	–	cnnvd
CVE	CVE-2022-42969	16 Oct 202200:00	–	cve