PyPI/urllib3 CVE-2021-33503: unknown, EPSS 3.27%

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking,

Action: Upgrade urllib3 to 1.26.5 or later.

pip install urllib3==1.26.5

Affected

Fixed versions

Sources

• osv: PYSEC-2021-108
• https://github.com/advisories/GHSA-q2q7-5pp4-w6pg
• https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec

CVE-2021-33503 · published 2021-06-29T11:15:00Z · modified 2026-10-13T09:30:02.842062535Z · JSON