CVE-2021-3733: Medium severity Python Python vulnerability
Last updated 25 August 2025
Other sources
Python is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the AbstractBasicAuthHandler class in urllib. By persuading a victim to visit a specially-crafted web site, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
The ReDoS-vulnerable regex has quadratic worst-case complexity and it allows cause a denial of service when identifying crafted invalid RFCs. This ReDoS issue is on the client side and needs remote attackers to control the HTTP server.
References:
https://bugs.python.org/issue43075 https://github.com/python/cpython/pull/24391
— Red Hat
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3733?
CVE-2021-3733 is a vulnerability in urllib's AbstractBasicAuthHandler class that allows an attacker to trigger a Regular Expression Denial of Service (ReDOS) during an authentication request.
What can an attacker do with CVE-2021-3733?
An attacker who controls a malicious HTTP server can exploit CVE-2021-3733 to launch a ReDOS attack on an HTTP client (e.g., web browser).
How severe is CVE-2021-3733?
CVE-2021-3733 has a severity rating of 6.5, which is considered medium.
Which software versions are affected by CVE-2021-3733?
CVE-2021-3733 affects Python versions 3.6.14, 3.7.11, 3.8.10, and 3.9.5, as well as other related packages.
How can I mitigate CVE-2021-3733?
To mitigate CVE-2021-3733, it is recommended to update to the fixed versions of Python and related packages provided by Red Hat.