---
id: CVE-2022-1930
aliases:
  - GHSA-v65g-f3cj-fjp4
  - PYSEC-2026-806
title: Regular expression denial of service in eth-account
summary: Regular expression denial of service in eth-account
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: eth-account
product: eth-account
ecosystem: pip
affected:
  - eth-account < 0.5.9
patched:
  - eth-account 0.5.9
published: '2022-08-23'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-v65g-f3cj-fjp4'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-1930'
  - url: >-
      https://github.com/ethereum/eth-account/commit/70f89be700df0d5f08ef696252c88741f8414060
  - url: 'https://github.com/ethereum/eth-account'
  - url: 'https://research.jfrog.com/vulnerabilities/eth-account-redos-xray-248681'
tags:
  - osv
  - pip
epss: 0.00892
epssPercentile: 0.57957
ingestedAt: '2026-07-08T18:25:53.096Z'
---

## Overview

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method

## Affected packages

- `eth-account < 0.5.9`

## Remediation

Upgrade to a patched release:

- `eth-account 0.5.9`