CVE-2022-39280

dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.

• CWE-400
• CWE-1333

• https://github.com/pyupio/dparse/commit/8c990170bbd6c0cf212f1151e9025486556062d5Patch, Third Party Advisory
• https://github.com/pyupio/dparse/commit/d87364f9db9ab916451b1b036cfeb039e726e614Patch, Third Party Advisory
• https://github.com/pyupio/dparse/security/advisories/GHSA-8fg9-p83m-x5pqThird Party Advisory
• https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoSTechnical Description, Third Party Advisory
• https://github.com/pyupio/dparse/commit/8c990170bbd6c0cf212f1151e9025486556062d5Patch, Third Party Advisory
• https://github.com/pyupio/dparse/commit/d87364f9db9ab916451b1b036cfeb039e726e614Patch, Third Party Advisory
• https://github.com/pyupio/dparse/security/advisories/GHSA-8fg9-p83m-x5pqThird Party Advisory
• https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoSTechnical Description, Third Party Advisory

Published

Oct 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39275Saleor is a headless, GraphQL commerce platform. In affected…4.3
• CVE-2022-39276GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…5.3
• CVE-2022-39277GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…4.8
• CVE-2022-39278Istio is an open platform-independent service mesh that prov…7.5
• CVE-2022-39279discourse-chat is a plugin for the Discourse message board w…5.4
• CVE-2022-3928 Hardcoded credential is found in affected products' message…5.5
• CVE-2022-39281fat_free_crm is a an open source, Ruby on Rails customer rel…6.5
• CVE-2022-39282FreeRDP is a free remote desktop protocol library and client…7.5
• CVE-2022-39283FreeRDP is a free remote desktop protocol library and client…7.5
• CVE-2022-39284CodeIgniter is a PHP full-stack web framework. In versions p…4.3
• CVE-2022-39285ZoneMinder is a free, open source Closed-circuit television …5.4
• CVE-2022-39286Jupyter Core is a package for the core common functionality …8.8