PT-2020-5140 · Python+1 · Urllib3+1
Published
2020-03-06
·
Updated
2026-05-19
·
CVE-2020-7212
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
urllib3 library versions 1.25.2 through 1.25.7
Description
The issue is related to an inefficient algorithm in the encode invalid chars function, which can lead to a denial of service due to CPU consumption. This happens because the percent encodings array is not deduplicated, resulting in a time complexity of O(N^2) for a URL of length N. If the array were deduplicated, the time complexity would be reduced to O(kN), where k is a constant. The vulnerability can be exploited by a remote attacker to cause a denial of service.
Recommendations
For versions 1.25.2 through 1.25.7, consider updating to a version where the encode invalid chars function is optimized to deduplicate the percent encodings array, thus reducing the time complexity and mitigating the denial of service risk.
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Urllib3