CoreCVE
Back

HIGH

python-urllib3: ReDoS in the parsing of authority part of URL

Published Jun 29, 2021

Description

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Affected products

Remediation

Red Hat statement

* Red Hat OpenShift Container Platform (OCP) 4 delivers the python-urllib3 package which includes a vulnerable version of urllib3 module, however from OCP 4.6 the python-urllib3 package is no longer shipped. OCP 4.5 is out of support scope for Moderate and Low impact vulnerabilities, hence is marked Out Of Support Scope. The python-urllib3 package used in OCP 3.11 is not affected by this flaw.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-835

References (15)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 29, 2021
Updated Aug 3, 2024
Reserved May 21, 2021
Link CVE-2021-33503
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2021-33503
Red Hat
Severity Moderate
Public date Jun 1, 2021
Links CVE-2021-33503 - Bugzilla
GHSA-Q2Q7-5PP4-W6PG