ALPINE-CVE-2022-45061
Record from OSV · Published November 9, 2022
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| python3 | Alpine:v3.17 | 3.10.9-r0 |
| python3 | Alpine:v3.18 | 3.11.1-r0 |
| python3 | Alpine:v3.15 | 3.9.16-r0 |
| python3 | Alpine:v3.19 | 3.11.1-r0 |
| python3 | Alpine:v3.23 | 3.11.1-r0 |
| python3 | Alpine:v3.21 | 3.11.1-r0 |
| python3 | Alpine:v3.22 | 3.11.1-r0 |
| python3 | Alpine:v3.16 | 3.10.9-r0 |
| python3 | Alpine:v3.14 | 3.9.16-r0 |
| python3 | Alpine:v3.24 | 3.11.1-r0 |
| python3 | Alpine:v3.20 | 3.11.1-r0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.17 | python3 | 3.4.1-r0, 3.4.2-r0, 3.4.2-r1 |
| Alpine:v3.18 | python3 | 3.10.0-r0, 3.1.3-r0, 0 |
| Alpine:v3.15 | python3 | 3.1.3-r0, 3.3.2-r0, 3.3.3-r0 |
| Alpine:v3.19 | python3 | 3.6.3-r3, 0, 3.1.3-r0 |
| Alpine:v3.23 | python3 | 3.1.3-r0, 0, 3.10.0-r1 |
| Alpine:v3.21 | python3 | 3.1.3-r0, 3.10.0-r0, 3.10.0-r1 |
| Alpine:v3.22 | python3 | 3.9.6-r2, 3.8.2-r7, 3.6.1-r0 |
| Alpine:v3.16 | python3 | 3.8.2-r7, 3.8.2-r6, 3.8.2-r5 |
| Alpine:v3.14 | python3 | 3.5.1-r2, 3.5.0-r0, 3.6.3-r6 |
| Alpine:v3.24 | python3 | 0 |
| Alpine:v3.20 | python3 | 3.10.0-r1, 3.6.3-r5, 3.8.1-r1 |
Timeline
- Nov 9, 2022 CVE Published
- Jun 15, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln ALPINE-CVE-2022-45061
vulnetix vdb fixes ALPINE-CVE-2022-45061Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2022-45061/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart