Vulnerability PYSEC-2021-108
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 years ago
June 29, 2021 at 11:15 AM UTC
No summary available
1.25.4 - 1.26.4
1.25.4 - 1.26.4
Details
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
12 days ago
urllib3: Chunked Deflate streaming can enter an infinite loop
2.6.2 - 2.7.0 GHSA-gh4c-6fx4-qh6g
2.6.2 - 2.7.0 GHSA-gh4c-6fx4-qh6g
High Risk
12 days ago
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
1.10.3 - 2.7.0 GHSA-vxq7-64xx-v4gw
1.10.3 - 2.7.0 GHSA-vxq7-64xx-v4gw
High Risk
12 days ago
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
1.26.0 - 2.7.0 GHSA-8988-9cw3-xx77
1.26.0 - 2.7.0 GHSA-8988-9cw3-xx77
High Risk
3 months ago
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
1.22 - 2.6.2 PYSEC-2026-1996
1.22 - 2.6.2 PYSEC-2026-1996
Unknown
3 months ago
urllib3 streaming API improperly handles highly compressed data
1.0 - 2.5.0 PYSEC-2026-1994
1.0 - 2.5.0 PYSEC-2026-1994
Impacted packages
Timeline
Published
5 years ago
June 29, 2021 at 11:15 AM UTC
Fixed (1.26.5)
5 years ago
May 26, 2021 at 05:02 PM UTC
Last Modified
2 hours ago
October 13, 2026 at 09:30 AM UTC