Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

ÉLEVÉE 7.5CVE-2021-33503 · GHSA-q2q7-5pp4-w6pg · PYSEC-2021-108 · Published 29/06/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
urllib3 PyPI	`≥ 1.25.4, < 1.26.5`	`1.26.5`
enterprise manager ops center oracle	`= 12.4.0.0`	No fix yet
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	No fix yet
zfs storage appliance kit oracle	`= 8.8`	No fix yet
urllib3 python	`≥ 1.25.4, < 1.26.5`	`1.26.5`

Description

Impact

When provided with a URL containing many @ characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Patches

The issue has been fixed in urllib3 v1.26.5.

References

For more information

If you have any questions or comments about this advisory:

Ask in our community Discord
Email [email protected]

NVD description

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free