PT-2021-6018 · Python+10 · Urllib3+10
Published
2020-06-11
·
Updated
2026-05-19
·
CVE-2021-33503
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
urllib3 versions prior to 1.26.5
Description
The issue is related to an HTTP client vulnerability in Python urllib3, which is associated with uncontrolled resource consumption. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service. The vulnerability occurs when a URL containing many @ characters in the authority component is provided, causing the authority regular expression to exhibit catastrophic backtracking.
Recommendations
For versions prior to 1.26.5, update to version 1.26.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of URLs with multiple @ characters in the authority component to minimize the risk of exploitation. Avoid using URLs that may cause catastrophic backtracking in the authority regular expression until the issue is resolved.
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Urllib3