CVE-2021-33503

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.26.5

Description The issue is related to an HTTP client vulnerability in Python urllib3, which is associated with uncontrolled resource consumption. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service. The vulnerability occurs when a URL containing many @ characters in the authority component is provided, causing the authority regular expression to exhibit catastrophic backtracking.

Recommendations For versions prior to 1.26.5, update to version 1.26.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of URLs with multiple @ characters in the authority component to minimize the risk of exploitation. Avoid using URLs that may cause catastrophic backtracking in the authority regular expression until the issue is resolved.