CVE-2022-42964: 
Python vulnerability analysis and mitigation

An exponential ReDoS (Regular Expression Denial of Service) vulnerability was discovered in the pymatgen PyPI package, identified as CVE-2022-42964. The vulnerability was discovered by Denys Vozniuk of the JFrog Security Research Team and published on October 15, 2022. The issue affects the GaussianInput.from_string method when processing arbitrary input (JFrog Research).

The vulnerability is classified with a CVSS score of 5.9 and is categorized as CWE-1333. The issue manifests as an exponential Regular Expression Denial of Service (ReDoS) vulnerability that can be triggered when an attacker supplies arbitrary input to the GaussianInput.from_string method in the pymatgen package (JFrog Research).

When successfully exploited, this vulnerability can lead to a denial of service condition in applications using the affected pymatgen package. The exponential ReDoS nature of the vulnerability means that carefully crafted input can cause the application to consume excessive CPU resources, potentially making the service unresponsive (JFrog Research).

According to the Debian Security Tracker, the vulnerability has been fixed in version 2025.2.18+dfsg1-4 of the package. Users are advised to upgrade to this or later versions to mitigate the vulnerability (Debian Tracker).