Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

GHSA-q2q7-5pp4-w6pg

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-q2q7-5pp4-w6pg

Catastrophic backtracking in URL authority parser when passed URL containing many @ characters ### Impact When provided with a URL containing many `@` characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. ### Patches The issue has been fixed in urllib3 v1.26.5. ### References - CVE-2021-33503 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503 - JVNVU#92413403 (English) https://jvn.jp/en/vu/JVNVU92413403/ - JVNVU#92413403 (Japanese) https://jvn.jp/vu/JVNVU92413403/ - urllib3 v1.26.5 https://github.com/urllib3/urllib3/releases/tag/1.26.5 ### For more information If you have any questions or comments about this advisory: * Ask in our community Discord https://discord.gg/urllib3 * Email [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)

gitlab/pypi/urllib3/CVE-2021-33503

Catastrophic backtracking in URL authority parser when passed URL containing many @ characters When provided with a URL containing many `@` characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

pypa/urllib3/PYSEC-2021-108

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

pysec/PYSEC-2021-108

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.