CVE-2021-3733

MediumCVSS 6.5

Published: 10/03/2022(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.68%

92th percentile - higher than 92% of all known CVEs

Summary

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client connects to could trigger a Regular Expression Denial of Service (ReDoS) during an authentication request with a specially crafted payload sent by the server to the client. The greatest threat is to application availability.

Risk Assessment

An attacker can cause application unavailability (DoS) by overloading the regular expression, potentially leading to service disruption.

Recommendation

Update the urllib library to a version that includes a fix for this vulnerability, or apply timeouts for regular expressions.

Other vulnerabilities in urllib

CVE-2026-55553High
urllib for Node.js before versions 4.9.1 and 2.44.1 reuses caller-supplied options across redirects, including authorization headers and credentials, even when the redirect target has a different scheme, host, or port. This can cause sensitive credentials to be sent to an attacker-controlled redirected origin. This issue is fixed in versions 2.44.1 and 4.9.1.

Original NVD description (English source)

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS