CVE-2021-33503: urllib3 - Catastrophic Backtracking in Authority Regular Expression
Summary
CVE-2021-33503: An issue was discovered in urllib3 before 1.26.5. Affects urllib3 across 2 version ranges.
< 1.26.5
< 2d4a3fee6de2fa45eb82169361918f759269b4ec
Fixed in 2d4a3fee6de2fa45eb82169361918f759269b4ec. How to fix ↓
Also tracked for
- python-urllib3 · Debian:11
The same CVE-2021-33503 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a Python HTTP library that provides a simple interface for making HTTP requests. It is widely used in various Python applications and frameworks. This vulnerability affects urllib3 versions before 1.26.5. The library's authority regular expression is susceptible to catastrophic backtracking when processing URLs with a large number of @ characters in the authority component. This can lead to a denial of service if a malicious URL is passed as a parameter or redirected to via an HTTP redirect.
Vulnerability Detail
The vulnerability in urllib3 arises from a flaw in the authority regular expression. When presented with a URL containing numerous @ characters in the authority component, the regular expression exhibits catastrophic backtracking. This can cause the regular expression matching process to consume excessive time and resources, leading to a denial of service condition. An attacker could exploit this vulnerability by crafting a malicious URL and passing it as a parameter or redirecting to it via an HTTP redirect. The impact of this vulnerability can range from service disruption to complete unavailability.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2d4a3fee6de2fa45eb82169361918f759269b4ec
This is the first release that contains the fix.
pip install --upgrade "urllib3==2d4a3fee6de2fa45eb82169361918f759269b4ec"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the authority regular expression in urllib3 to prevent catastrophic backtracking. However, this approach is not recommended as it requires modifying the library's source code. It is strongly advised to upgrade to the latest version of urllib3 instead.
Conclusion
The vulnerability in urllib3 versions before 1.26.5 allows for catastrophic backtracking in the authority regular expression, leading to a denial of service condition. It is crucial to upgrade to the latest version of urllib3 (1.26.5 or later) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python HTTP library that provides a simple interface for making HTTP requests. It is widely used in various Python applications and frameworks.
Versions of urllib3 before 1.26.5 are affected by this vulnerability.
Catastrophic backtracking is a behavior exhibited by certain regular expressions when presented with certain inputs. It causes the regular expression matching process to consume excessive time and resources, leading to a denial of service condition.
An attacker can exploit this vulnerability by crafting a malicious URL containing a large number of @ characters in the authority component and passing it as a parameter or redirecting to it via an HTTP redirect.
The impact of this vulnerability can range from service disruption to complete unavailability, as it can cause a denial of service condition in applications using urllib3.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
