CVE-2021-3733
There's a flaw in urllib's AbstractBasicAuthHandler class.
Published Mar 10, 2022 · updated Oct 14, 2026 · python python
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Timeline
Detection, updates, and resolution for this record.
Mar 10, 2022 · NIST NVD
Detected
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availabil
Oct 14, 2026 · NIST NVD
Updated
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availabil
Affected
- cpe fedoraproject/extra packages for enterprise linux7.0
- cpe netapp/management services for element software and netapp hciversion unspecified
- cpe python/pythonversion unspecified
- cpe python/python3.10.0
- cpe redhat/codeready linux builder8.0
- cpe redhat/codeready linux builder for ibm z systems8.0
- cpe redhat/codeready linux builder for power little endian8.0
Sources
- CVE.orgCVE-2021-3733
Official CVE identifier
cve.org - NIST NVDCVE-2021-3733
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafte
nvd.nist.gov