CVE-2021-33503: Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-29 · updated 2026-06-17
Weakness: CWE-400

Description

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Affected products

Fedoraproject Fedora: 33, 34
Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
urllib3: from 1.25.4 before 1.26.5 — fixed in 1.26.5
Pypi Urllib3: from 1.25.4 before 1.26.5; 1.25.10, 1.25.11, 1.25.4, 1.25.5, 1.25.6, 1.25.7 (+7) — fixed in 1.26.5

How to fix

Upgrade to a fixed version: urllib3 1.26.5; Pypi Urllib3 1.26.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-33503 or the next vulnerability affects your stack