CVE-2022-33977

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.

• CWE-776

• https://github.com/stchris/untangleProduct, Third Party Advisory
• https://github.com/stchris/untangle/releases/tag/1.2.1Release Notes, Third Party Advisory
• https://jvn.jp/en/jp/JVN30454777/Third Party Advisory
• https://github.com/stchris/untangleProduct, Third Party Advisory
• https://github.com/stchris/untangle/releases/tag/1.2.1Release Notes, Third Party Advisory
• https://jvn.jp/en/jp/JVN30454777/Third Party Advisory

Published

Jul 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-33970Authenticated WordPress Options Change vulnerability in Bipl…7.2
• CVE-2022-33971Authentication bypass by capture-replay vulnerability exists…7.5
• CVE-2022-33972Incorrect calculation in microcode keying mechanism for some…4.4
• CVE-2022-33973Improper access control in the Intel(R) WAPI Security softwa…3.3
• CVE-2022-33974Cross-Site Request Forgery (CSRF) vulnerability in Smash Bal…8.8
• CVE-2022-33976Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-33978Reflected Cross-Site Scripting (XSS) vulnerability FontMeist…6.1
• CVE-2022-33979Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-3398OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-o…9.8
• CVE-2022-33980Apache Commons Configuration performs variable interpolation…9.8
• CVE-2022-33981drivers/block/floppy.c in the Linux kernel before 5.17.6 is …3.3
• CVE-2022-33982DMA attacks on the parameter buffer used by the Int15Service…6.4