High USN-5821-1 1 CVE

wheel vulnerability

Published Jan 24, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Sebastian Chnelik discovered that wheel incorrectly handled
certain file names when validated against a regex expression.
An attacker could possibly use this issue to cause a
denial of service.

Fixed packages 4

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	wheel	0.30.0-0.2ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS	wheel	0.34.2-1ubuntu0.1
Ubuntu · 22.04 LTS 22.04:LTS	wheel	0.37.1-2ubuntu0.22.04.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	wheel	0.24.0-1~ubuntu1.1+esm1

Vulnerabilities 1

High 7.5

CVE-2022-40898

pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)

An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.

python-pip python-wheel wheel wheel Debian Ubuntu Azure Linux PyPI

Dec 22, 2022

References

report
https://ubuntu.com/security/CVE-2022-40898