Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2021-3733 Details

Description

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://bugs.python.org/issue43075 CVEExploitIssue TrackingPatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1995234 CVEIssue TrackingThird Party Advisory
https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb CVEPatchThird Party Advisory
https://github.com/python/cpython/pull/24391 CVEPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html CVE

see all 17 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-400Uncontrolled Resource Consumption[email protected]
CWE-400Uncontrolled Resource Consumption[email protected]

Affected Products

ProductVersions

Change History

11 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2021-3733
NVD Published Date:
Mar 10, 2022
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2021-3733 Details - Not Deferred