CVE-2021-21240: httplib2 Denial of Service Vulnerability
Summary
CVE-2021-21240: httplib2 is a comprehensive HTTP client library for Python. Affects httplib2 across 2 version ranges.
< 0.19.0
< bd9ee252c8f099608019709e22c0d705e98d26bc
Fixed in bd9ee252c8f099608019709e22c0d705e98d26bc. How to fix ↓
Also tracked for
- python-httplib2 · Debian:11
The same CVE-2021-21240 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
httplib2 is a comprehensive HTTP client library for Python. It provides a wide range of features for making HTTP requests and handling responses. The library is commonly used in Python applications to interact with web services and APIs. However, versions of httplib2 prior to 0.19.0 are vulnerable to a Denial of Service (DoS) attack. This vulnerability can be exploited by a malicious server that responds with a long series of non-breaking space characters ("\xa0") in the "www-authenticate" header. When the httplib2 client accesses such a server, it can experience a CPU burn while parsing the header, leading to a DoS condition.
Vulnerability Detail
The vulnerability in httplib2 arises from a flaw in the parsing of auth headers. By sending a specially crafted "www-authenticate" header with a long series of non-breaking space characters, an attacker can cause the httplib2 client to enter a CPU-intensive loop while attempting to parse the header. This can result in excessive CPU usage and a denial of service for the client application. The vulnerability has been assigned the CVE identifier CVE-2021-21240 and the GHSA identifier GHSA-93xj-8mrv-444m. It has been fixed in version 0.19.0 of httplib2, which introduces a new implementation of auth headers parsing using the pyparsing library.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "httplib2==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
bd9ee252c8f099608019709e22c0d705e98d26bc
This is the first release that contains the fix.
pip install --upgrade "httplib2==bd9ee252c8f099608019709e22c0d705e98d26bc"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of httplib2 as soon as possible.
Conclusion
The httplib2 library in versions prior to 0.19.0 is vulnerable to a Denial of Service (DoS) attack. By sending a specially crafted header, a malicious server can cause excessive CPU usage in the httplib2 client, leading to a DoS condition. This vulnerability has been fixed in version 0.19.0, and it is crucial for developers to update their httplib2 dependency to this version or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httplib2 →
FAQ
httplib2 is a Python library for making HTTP requests and handling responses. It is commonly used in Python applications to interact with web services and APIs.
The vulnerability can be exploited by a malicious server to cause a denial of service (DoS) condition in the httplib2 client. This can result in excessive CPU usage and unresponsiveness of the client application.
To fix this vulnerability, update the httplib2 package to version 0.19.0 or later. This can be done by updating the package version in your project's dependency file and running the package manager to install the updated version.
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of httplib2.
Yes, this vulnerability has been fixed in version 0.19.0 of httplib2. It is important to update to this version or later to protect against the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for httplib2.
