PT-2023-12176 · Pypi+2 · Mechanize+2

Erik Krogh Kristensen + 3 · Published 2022-04-05 · Updated 2025-12-22 · CVE-2021-32837

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions mechanize versions prior to 0.4.6

Description The mechanize library, used for automatically interacting with HTTP web servers, contains a regular expression vulnerable to regular expression denial of service (ReDoS). If a web server responds maliciously, mechanize could crash.

Recommendations For versions prior to 0.4.6, update to version 0.4.6 to resolve the issue. As a temporary workaround, consider restricting interactions with potentially malicious web servers until the patch is applied.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

ALT-PU-2022-1635

ALT-PU-2024-15187

ALT-PU-2024-8936

CVE-2021-32837

DLA-3460-1

DLA-4418-1

GHSA-G3PV-PJ5F-3HFQ

MGASA-2023-0036

OPENSUSE-SU-2023:0030-1

OPENSUSE-SU-2024:12621-1

OPENSUSE-SU-2025:15098-1

PYSEC-2023-25

Affected Products

Alt Linux

Debian

Mechanize

References · 32

• 🔥 https://github.com/python-mechanize/mechanize/blob/3acb1836f3fd8edc5a758a417dd46b53832ae3b5/mechanize/_urllib2_fork.py#L878-L879 · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2021-108-python-mechanize-mechanize · Exploit
• https://github.com/python-mechanize/mechanize/commit/dd05334448e9f39814bab044d2eaa5ef69b410d6 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2023:0030-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32837 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-32837 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0036.html · Security Note
• https://osv.dev/vulnerability/CVE-2021-32837 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32837 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3460-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0036 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4418-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32837 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-25 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g3pv-pj5f-3hfq · Vendor Advisory