https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:03:44.669604+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-33503 CVE-2021-33503 2026-10-03T07:03:44.740624+00:00

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

 https://cve.radiocsirt.org/vuln/ghsa-q2q7-5pp4-w6pg GHSA-q2q7-5pp4-w6pg — Catastrophic backtracking in URL authority parser when passed URL containing many @ characters 2026-10-03T07:03:44.740703+00:00

Affected: PyPI: urllib3

### Impact

When provided with a URL containing many `@` characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

### Patches

The issue has been fixed in urllib3 v1.26.5.

### References

- [CVE-2021-33503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503) - [JVNVU#92413403 (English)](https://jvn.jp/en/vu/JVNVU92413403/) - [JVNVU#92413403 (Japanese)](https://jvn.jp/vu/JVNVU92413403/) - [urllib3 v1.26.5](https://github.com/urllib3/urllib3/releases/tag/1.26.5)

### For more information If you have any questions or comments about this advisory: * Ask in our [community Discord](https://discord.gg/urllib3) * Email [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)

 https://cve.radiocsirt.org/vuln/pysec-2021-108 PYSEC-2021-108 2026-10-03T07:03:44.740757+00:00

Affected: PyPI: urllib3

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.