Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

HIGH 7.5CVE-2021-33503 · GHSA-q2q7-5pp4-w6pg · PYSEC-2021-108 · Published 29/06/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
urllib3 PyPI	`≥ 1.25.4, < 1.26.5`	`1.26.5`
enterprise manager ops center oracle	`= 12.4.0.0`	No fix yet
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	No fix yet
zfs storage appliance kit oracle	`= 8.8`	No fix yet
urllib3 python	`≥ 1.25.4, < 1.26.5`	`1.26.5`

Description

Impact

When provided with a URL containing many @ characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Patches

The issue has been fixed in urllib3 v1.26.5.

References

For more information

If you have any questions or comments about this advisory:

Ask in our community Discord
Email [email protected]

NVD description

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

References

urllib3/urllib3 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-33503 · ADVISORY
urllib3/urllib3 commit 2d4a3fe · WEB
urllib3/urllib3 commit 5b047b6 · WEB
GitHub Advisory GHSA-q2q7-5pp4-w6pg · ADVISORY
pypa/advisory-database · WEB
urllib3/urllib3 · PACKAGE
lists.fedoraproject.org/archives/list/[email protected]/message/6SCV7ZNAHS3E6PBFLJGENCDRDRWRZZ6W · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/FMUGWEAUYGGHTPPXT6YBD53WYXQGVV73 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free