Denial of Service Vulnerability in Asteval Python Expression Evaluator

CVE-2026-55244

What is CVE-2026-55244?

The Asteval Python expression evaluator has a vulnerability that allows untrusted expressions to bypass safety handlers in the interpreter. Versions prior to 1.0.9 are affected, as they improperly expose certain BaseException subclasses. This oversight can lead to denial of service, where an attacker can cause disruptions or crashes in applications by raising a non-Exception BaseException, compromising the stability of services that execute untrusted expressions. The issue has been resolved in version 1.0.9, enhancing the security posture of applications utilizing Asteval.

References