CVE-2021-33503High· 7.5▾ TwilightAn issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
3.2%
3.2% → 3.3%
Last analysed / modified upstream
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
urllib3 >= 1.25.4, < 1.26.5Upgrade to a patched release:
urllib3 1.26.5Connected by shared product, vendor, weakness, or advisory.
CVE-2021-28363Medium· 6.5The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies
CVE-2026-97688Medium· 5.3urllib3 is an HTTP client library for Python
CVE-2026-97689High· 7.5urllib3 is an HTTP client library for Python
CVE-2026-97687High· 8.1urllib3 is an HTTP client library for Python
CVE-2023-43804Medium· 5.9`Cookie` HTTP header isn't stripped on cross-origin redirects
CVE-2023-45803Medium· 4.2urllib3's request body not stripped after redirect from 303 status changes request method to GET