CVE-2020-7212: urllib3 Denial of Service Vulnerability
Summary
CVE-2020-7212: The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. Affects urllib3 across 2 version ranges.
>= 1.25.2, < 1.25.8
< a74c9cfbaed9f811e7563cfc3dce894928e0221a
Fixed in a74c9cfbaed9f811e7563cfc3dce894928e0221a. How to fix ↓
Also tracked for
- python-urllib3 · Debian:11
The same CVE-2020-7212 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful HTTP client library for Python, providing a simple and intuitive API for making HTTP requests. It is widely used in various Python applications and frameworks. However, versions 1.25.2 through 1.25.7 of urllib3 are vulnerable to a denial of service (CPU consumption) attack due to an inefficient algorithm in the _encode_invalid_chars function of the util/url.py module. This vulnerability can be exploited by an attacker to cause excessive CPU usage, leading to service degradation or unavailability.
Vulnerability Detail
The _encode_invalid_chars function in urllib3's util/url.py module suffers from an inefficient algorithm. The percent_encodings array, which contains all matches of percent encodings, is not deduplicated. As a result, for a URL of length N, the size of percent_encodings may be up to O(N). The next step, which involves normalizing existing percent-encoded bytes, also takes up to O(N) for each step. Consequently, the total time complexity of the _encode_invalid_chars function is O(N^2). If percent_encodings were deduplicated, the time complexity would be reduced to O(kN), where k is at most 484 ((10+6*2)^2). This vulnerability can be exploited by an attacker to consume excessive CPU resources, potentially leading to a denial of service condition.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
a74c9cfbaed9f811e7563cfc3dce894928e0221a
This is the first release that contains the fix.
pip install --upgrade "urllib3==a74c9cfbaed9f811e7563cfc3dce894928e0221a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade urllib3 to the latest version as soon as possible.
Conclusion
The urllib3 library versions 1.25.2 through 1.25.7 are vulnerable to a denial of service attack due to an inefficient algorithm. It is crucial to upgrade urllib3 to version 1.25.8 or later to mitigate this vulnerability. Failure to do so may result in excessive CPU consumption, leading to service degradation or unavailability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python library that provides a high-level interface for making HTTP requests. It is commonly used in Python applications and frameworks to handle HTTP communication.
This vulnerability allows an attacker to consume excessive CPU resources, potentially leading to a denial of service condition. This can result in service degradation or unavailability.
Versions 1.25.2 through 1.25.7 of urllib3 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to upgrade urllib3 to the latest version.
You can update urllib3 to the latest version by running the command 'pip install --upgrade urllib3'.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
