CVE-2022-42969

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.

• CWE-1333
• CWE-1333

• https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316Product
• https://github.com/pytest-dev/py/issues/287Exploit, Issue Tracking, Third Party Advisory
• https://news.ycombinator.com/item?id=34163710Issue Tracking, Third Party Advisory
• https://pypi.org/project/pyProduct
• https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316Product
• https://github.com/pytest-dev/py/issues/287Exploit, Issue Tracking, Third Party Advisory
• https://news.ycombinator.com/item?id=34163710Issue Tracking, Third Party Advisory
• https://pypi.org/project/pyProduct

Published

Oct 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42961An issue was discovered in wolfSSL before 5.5.0. A fault inj…5.3
• CVE-2022-42964An exponential ReDoS (Regular Expression Denial of Service) …7.5
• CVE-2022-42965An exponential ReDoS (Regular Expression Denial of Service) …7.5
• CVE-2022-42966An exponential ReDoS (Regular Expression Denial of Service) …7.5
• CVE-2022-42967Caret is vulnerable to an XSS attack when the user opens a c…9.6
• CVE-2022-42968Gitea before 1.17.3 does not sanitize and escape refs in the…9.8
• CVE-2022-4297The WP AutoComplete Search WordPress plugin through 1.0.4 do…9.8
• CVE-2022-42970A CWE-306: Missing Authentication for Critical Function The …9.8
• CVE-2022-42971A CWE-434: Unrestricted Upload of File with Dangerous Type v…9.8
• CVE-2022-42972A CWE-732: Incorrect Permission Assignment for Critical Reso…7.8
• CVE-2022-42973A CWE-798: Use of Hard-coded Credentials vulnerability exist…7.8
• CVE-2022-42974In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web applic…4.8