Updated: 2026-01-19 04:12:56.957523
Description:
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | HIGH | 7.1 |
| CVSS Version 3.x | MEDIUM | 6.5 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated | Statement |
|---|---|---|---|---|---|---|---|---|
| Alpine Linux 3.22 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2026-01-27 16:43:50 | ||
| Debian 10 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2025-09-09 19:26:40 | ||
| Debian 10 | python | 2.7 | 6.5 | MEDIUM | Released | CLSA-2025:1760369860 | 2025-10-13 17:00:51 | |
| Debian 11 | python | 2.7 | 6.5 | MEDIUM | Released | CLSA-2025:1760369775 | 2025-10-13 17:00:49 | |
| Debian 11 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2025-09-09 19:26:40 | ||
| Debian 12 | python | 3.7 | 6.5 | MEDIUM | Not Vulnerable | 2025-12-09 20:17:12 | ||
| Debian 12 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2025-09-09 19:26:39 | ||
| Debian 12 | python | 2.7 | 6.5 | MEDIUM | Released | CLSA-2025:1760369700 | 2025-10-13 17:00:47 | |
| Debian 12 | python | 3.8 | 6.5 | MEDIUM | Not Vulnerable | 2025-12-09 20:17:11 | ||
| Debian 13 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2025-10-03 19:04:21 |