Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 799413 (CVE-2021-33503) - <dev-python/urllib3-1.26.5: ReDoS vulnerability (CVE-2021-33503)
Summary: <dev-python/urllib3-1.26.5: ReDoS vulnerability (CVE-2021-33503)
Alias: CVE-2021-33503
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: A3 [glsa+ cve]
Depends on:
Reported: 2021-07-01 02:10 UTC by John Helmert III
Modified: 2021-07-15 17:11 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---
nattka: sanity-check+


Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III gentoo-dev Security 2021-07-01 02:10:53 UTC

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Please stabilize.
Comment 1 Sam James archtester gentoo-dev Security 2021-07-01 08:59:46 UTC
amd64 arm arm64 hppa ppc ppc64 sparc x86 (ALLARCHES) done

all arches done
Comment 2 John Helmert III gentoo-dev Security 2021-07-13 14:50:20 UTC
GLSA request filed.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2021-07-15 05:26:24 UTC
This issue was resolved and addressed in
 GLSA 202107-36 at
by GLSA coordinator John Helmert III (ajak).
Comment 4 John Helmert III gentoo-dev Security 2021-07-15 05:31:11 UTC
Reopening for cleanup
Comment 5 Larry the Git Cow gentoo-dev 2021-07-15 17:06:14 UTC
The bug has been referenced in the following commit(s):

commit f47a46e8ba0bc6982eab353a5e69e8e143e7e2d7
Author:     Michał Górny <>
AuthorDate: 2021-07-15 17:04:21 +0000
Commit:     Michał Górny <>
CommitDate: 2021-07-15 17:04:24 +0000

    dev-python/urllib3: Remove old
    Signed-off-by: Michał Górny <>

 dev-python/urllib3/Manifest                        |  1 -
 .../files/urllib3-1.26.4-test-ssltransport.patch   | 31 -------
 dev-python/urllib3/urllib3-1.26.4.ebuild           | 97 ----------------------
 3 files changed, 129 deletions(-)
Comment 6 John Helmert III gentoo-dev Security 2021-07-15 17:11:48 UTC
Thank you! All done.