mechanize Regular Expression Denial of Service vulnerability

HIGH 7.5CVE-2021-32837 · GHSA-g3pv-pj5f-3hfq · PYSEC-2023-25 · Published 17/01/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
mechanize PyPI	`< 0.4.6`	`0.4.6`
mechanize mechanize_project	`< 0.4.6`	`0.4.6`

Description

mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-32837 · ADVISORY
python-mechanize/mechanize commit dd05334 · WEB
pypa/advisory-database · WEB
python-mechanize/mechanize · PACKAGE
python-mechanize/mechanize · WEB
python-mechanize/mechanize release v0.4.6 · WEB
lists.debian.org/debian-lts-announce/2023/06/msg00022.html · WEB
lists.debian.org/debian-lts-announce/2025/12/msg00028.html · WEB
securitylab.github.com/advisories/GHSL-2021-108-python-mechanize-mechanize · ADVISORY
securitylab.github.com/advisories/GHSL-2021-108-python-mechanize-mechanize · Exploit
GitHub Advisory GHSA-g3pv-pj5f-3hfq · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free