# CVE-2022-40023: python3-mako: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse

CVE-2022-40023 is fixed in 4 products on 1 platform, first by python-mako 1.0.7+ds1-1ubuntu0.2, released September 7, 2022. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-40023
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.0232
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 7, 2022

## Description

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | mako Debian 11.6 (bullseye) | 1.1.3+ds1-2+deb11u1 | [DLA-4393-1](https://patchblox.com/security/data/fix/linux/dla-4393-1.md) | Dec 3, 2025 |
| Linux | mako Debian 12.15 (bookworm) | 1.2.2+ds1-1 | [DEBIAN-CVE-2022-40023](https://patchblox.com/security/data/fix/linux/debian-cve-2022-40023.md) | Sep 7, 2022 |
| Linux | mako Debian 13.5 (trixie) | 1.2.2+ds1-1 | [DEBIAN-CVE-2022-40023](https://patchblox.com/security/data/fix/linux/debian-cve-2022-40023.md) | Sep 7, 2022 |
| Linux | mako Debian 14 | 1.2.2+ds1-1 | [DEBIAN-CVE-2022-40023](https://patchblox.com/security/data/fix/linux/debian-cve-2022-40023.md) | Sep 7, 2022 |
| Linux | python-mako Ubuntu 18.04.6 LTS (bionic) | 1.0.7+ds1-1ubuntu0.2 | [python-mako 1.0.7+ds1-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-mako-1.0.7-ds1-1ubuntu0.2.md) | Sep 7, 2022 |
| Linux | python-mako Ubuntu 20.04 LTS (focal) | 1.1.0+ds1-1ubuntu2.1 | [python-mako 1.1.0+ds1-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python-mako-1.1.0-ds1-1ubuntu2.1.md) | Sep 7, 2022 |
| Linux | python-mako rocky 8 | 0:1.0.6-14.el8 | [RLSA-2023:2893](https://patchblox.com/security/data/fix/linux/rlsa-2023-2893.md) | Dec 3, 2025 |
| Linux | python-mako rocky 9 | 0:1.1.4-6.el9 | [RLSA-2023:2258](https://patchblox.com/security/data/fix/linux/rlsa-2023-2258.md) | Dec 3, 2025 |
| Linux | python-mako-doc amzn 2023 | 1.1.4-3.amzn2023.0.3 | [ALAS2023-2023-288](https://patchblox.com/security/data/fix/linux/alas2023-2023-288.md) | Aug 3, 2023 |
| Linux | python3-mako RHEL 8 | 0:1.0.6-14.el8 | [RHSA-2023:2893](https://patchblox.com/security/data/fix/linux/rhsa-2023-2893.md) | May 16, 2023 |
| Linux | python3-mako RHEL 9 | 0:1.1.4-6.el9 | [RHSA-2023:2258](https://patchblox.com/security/data/fix/linux/rhsa-2023-2258.md) | May 9, 2023 |
| Linux | python3-mako Ubuntu 18.04.6 LTS (bionic) | 1.0.7+ds1-1ubuntu0.2 | [python3-mako 1.0.7+ds1-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-mako-1.0.7-ds1-1ubuntu0.2.md) | Sep 7, 2022 |
| Linux | python3-mako Ubuntu 20.04 LTS (focal) | 1.1.0+ds1-1ubuntu2.1 | [python3-mako 1.1.0+ds1-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-mako-1.1.0-ds1-1ubuntu2.1.md) | Sep 7, 2022 |
| Linux | python3-mako Ubuntu 22.04.1 LTS (jammy) | 1.1.3+ds1-2ubuntu0.1 | [python3-mako 1.1.3+ds1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-mako-1.1.3-ds1-2ubuntu0.1.md) | Sep 7, 2022 |
| Linux | python3-mako almalinux 8 | 1.0.6-14.el8 | [ALSA-2023:2893](https://patchblox.com/security/data/fix/linux/alsa-2023-2893.md) | May 16, 2023 |
| Linux | python3-mako almalinux 9 | 1.1.4-6.el9 | [ALSA-2023:2258](https://patchblox.com/security/data/fix/linux/alsa-2023-2258.md) | May 9, 2023 |
| Linux | python3-mako amzn 2023 | 1.1.4-3.amzn2023.0.3 | [ALAS2023-2023-288](https://patchblox.com/security/data/fix/linux/alas2023-2023-288.md) | Aug 3, 2023 |
| Linux | python3-mako ol 8 | 0:1.0.6-14.el8 | [ELSA-2023-2893](https://patchblox.com/security/data/fix/linux/elsa-2023-2893.md) | May 24, 2023 |
| Linux | python3-mako ol 9 | 0:1.1.4-6.el9 | [ELSA-2023-2258](https://patchblox.com/security/data/fix/linux/elsa-2023-2258.md) | May 15, 2023 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.