CVE-2021-3733
- State
- Published
- Severity
- Not scored
- Published
- Mar 7, 2022
- Updated
- Oct 14, 2026
- Reserved
- Aug 23, 2021
Description
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Scores
The record has no CVSS score.
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
pythonn/a |
|
References
- https://bugs.python.org/issue43075
- https://bugzilla.redhat.com/show_bug.cgi?id=1995234
- https://github.com/python/cpython/pull/24391
- https://ubuntu.com/security/CVE-2021-3733
- https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb
- https://security.netapp.com/advisory/ntap-20220407-0001/
- [debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security updatemailing-list
- [debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security updatemailing-list
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.