A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00337
Percentile: 0.55877

CVSS Scoring

Mapped CWE(s)

• CWE-704 : Incorrect Type Conversion or Cast

Affected Products

• cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:beta3:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:beta4:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:beta5:*:*:*:*:*:*
• cpe:2.3:a:python:python:3.11.0:rc1:*:*:*:*:*:*
• cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

← Back to Home