There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Fix
Patch, vendor advisory and mitigation references on NVD 8
- https://bugs.python.org/issue43075 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb Patch, Third Party Advisory
- https://github.com/python/cpython/pull/24391 Patch, Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3733 Patch, Third Party Advisory
- https://bugs.python.org/issue43075 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb Patch, Third Party Advisory
- https://github.com/python/cpython/pull/24391 Patch, Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3733 Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · python, redhat, fedoraprojectNVD modified 2026-10-14 10:17
Affected (CPE criteria) 24
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*cpe:2.3:a:python:python:3.10.0:-:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
References 18
- https://bugs.python.org/issue43075 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995234 Issue Tracking, Third Party Advisory
- https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb Patch, Third Party Advisory
- https://github.com/python/cpython/pull/24391 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://security.netapp.com/advisory/ntap-20220407-0001/ Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3733 Patch, Third Party Advisory
- https://bugs.python.org/issue43075 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995234 Issue Tracking, Third Party Advisory
- https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb Patch, Third Party Advisory
- https://github.com/python/cpython/pull/24391 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://security.netapp.com/advisory/ntap-20220407-0001/ Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3733 Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html