GitHub Advisoryadvisory · PyPI

GHSA-q2q7-5pp4-w6pg Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

HIGH Published 2021-06-01 Modified 2026-06-09 Official page ↗
Aliases
CVE-2021-33503
Ecosystem
PyPI
Packages
urllib3
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-05-28

Affected packages

• PyPI urllib3: >= 1.25.4, < 1.26.5 → fixed in 1.26.5

Description

Impact When provided with a URL containing many `@` characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. Patches The issue has been fixed in urllib3 v1.26.5. References • CVE-2021-33503 • JVNVU#92413403 (English) • JVNVU#92413403 (Japanese) • urllib3 v1.26.5 For more information If you have any questions or comments about this advisory: • Ask in our community Discord • Email [email protected]

Related

Alias · CVE (1)

  • CVE-2021-33503 An issue was discovered in urllib3 before 1.26.5. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References