CVE-2021-33503

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

References

Affected packages

Git / github.com/urllib3/urllib3

Affected ranges

Type

GIT

Repo

https://github.com/urllib3/urllib3

Events

Introduced

7e856c04723036934fe314c63701466e4f42d2ee

Fixed

d1616473df94b94f0f5ad19d2a6608cfe93b7cdf

Fixed

2d4a3fee6de2fa45eb82169361918f759269b4ec

Database specific

{
    "versions": [
        {
            "introduced": "1.25.4"
        },
        {
            "fixed": "1.26.5"
        }
    ]
}

Affected versions

1.*

1.25.4

1.25.5

1.25.6

1.25.7

1.25.8

1.26.0

1.26.1

1.26.2

1.26.3

1.26.4

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "34"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.4.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "17.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "17.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "17.3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-33503.json"