Read the docs
TI-2022-19473 Aliases CVE-2022-40899GHSA-v3c5-jqr6-7qm8

An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers…

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01925 80th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial future (PyPI): 0.18.3Red Hat: 3 advisoriesRed Hat: 3 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—future (PyPI)before 0.18.30.18.3Patch availableGHSA-v3c5-jqr6-7qm8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • future (PyPI) Vendor— Affected before 0.18.3 Fixed in 0.18.3 Patch available GHSA-v3c5-jqr6-7qm8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pythoncharmers:python-future:*:*:*:*:*:python:*:*up to 0.18.2VulnerablePythoncharmers
  • cpe:2.3:a:pythoncharmers:python-future:*:*:*:*:*:python:*:* Versions up to 0.18.2 Vulnerable ·Pythoncharmers

Remediation

  • Fix · GHSA-v3c5-jqr6-7qm8 future (PyPI) Fixed in 0.18.3 Advisory →

Red Hat 3 advisories

  • RHSA-2023:6818 Released 2023-11-08 · Red Hat rating Important
    Satellite 6.14 security and bug fix update
    • Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
  • RHSA-2023:4466 Released 2023-08-03 · Red Hat rating Important
    Satellite 6.13.3 Async Security Update
    • Red Hat Satellite 6.13 for RHEL 8 python-future-0.18.3-1.el8pc, python39-future-0.18.3-1.el8pc, rubygem-safemode-1.3.8-1.el8sat
  • RHSA-2023:2101 Released 2023-05-03 · Red Hat rating Moderate
    RHUI 4.4.0 release - Security Fixes, Bug Fixes, and Enhancements Update
    • RHUI 4 for RHEL 8 python-django-3.2.18-1.0.1.el8ui, python-future-0.18.3-1.0.1.el8ui, python39-django-3.2.18-1.0.1.el8ui +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 16.1AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
RHUI 4 for RHEL 8Fixed RHSA-2023:2101
Red Hat Satellite 6.13 for RHEL 8Fixed RHSA-2023:4466
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2023:6818
Not affected: 6 products
  • RHUI 4 for RHEL 8
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.0
  • Red Hat Satellite 6.13 for RHEL 8
  • Red Hat Satellite 6.14 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40899
  2. 2026-10-03 Alias added: GHSA-v3c5-jqr6-7qm8

References

Exploit 2

Patch 1

Advisory 3

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences