CVE-2020-8492: High severity Python Python vulnerability
Last updated 25 August 2025
Other sources
Multiple python versions allow an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
Upstream Issue:
https://bugs.python.org/issue39503
— Red Hat
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
Python is vulnerable to a denial of service, caused by a flaw in the urllib.request.AbstractBasicAuthHandler. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a Regular Expression Denial of Service (ReDoS).
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-8492.
What is the severity of CVE-2020-8492?
The severity of CVE-2020-8492 is medium.
What is the description of CVE-2020-8492?
CVE-2020-8492 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client.
Which software versions are affected by CVE-2020-8492?
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 are affected by CVE-2020-8492.
How can I fix CVE-2020-8492?
To fix CVE-2020-8492, update Python to version 3.6.8-17.el7, 3.6.8-31.el8, 3.6.12-1.el6, 9.0.1-5.el6, 15.1.0-3.el6, 3.6.12-1.el7, 9.0.1-5.el7, or 15.1.0-3.el7, or Python to version 3.8.3.