CVE-2022-42966

What it actually does

Triggers exponential-time backtracking in a regular expression inside cleo when attacker-controlled input reaches Table.set_rows, exhausting CPU and causing denial of service.

Why it matters to the business

Applications or services depending on cleo can be forced offline or slowed to unusability by a single unauthenticated request; the issue has been public for nearly four years with publicly available exploit code and a modest but rising exploitation probability.

How an attack unfolds

An attacker locates any code path that passes untrusted data into cleo’s Table.set_rows, crafts a string that forces catastrophic regex backtracking, and sends it over the network; the process consumes a full CPU core for an extended period, starving other requests and potentially crashing the worker.

How to fix it

Upgrade python-poetry/cleo to the commit 108f8214ef03107facafcba84379363768723fbd or later; rebuild and redeploy any containers or packages that depend on cleo; verify the updated dependency tree contains no older cleo versions.

How to confirm the fix worked

Inspect the resolved dependency versions in the environment to confirm cleo is at or beyond commit 108f8214ef03107facafcba84379363768723fbd; run a synthetic request containing the known ReDoS pattern and confirm CPU time remains bounded.

Typical attack path

1. Identify an application or API endpoint that ultimately calls cleo Table.set_rows with user input
2. Craft a malicious payload designed to trigger ReDoS in the package’s regex
3. Transmit the payload in a single request with no authentication required
4. Observe sustained high CPU usage or request timeouts on the target process

How to detect it

Search web-server and application logs for unusually long request durations or high-CPU worker processes around calls involving cleo Table handling; correlate with any sudden spikes in CPU metrics on services that import cleo.

What your security team should do

• Immediately update all direct and transitive dependencies on cleo to the fixed commit
• Add cleo to automated dependency-scanning policies with enforcement on build
• Review any custom code that calls Table.set_rows and ensure input is sanitized or length-bounded until the library is updated
• Monitor EPSS trend and exploit availability; treat as higher priority if EPSS continues to rise