Updated: 2026-01-19 04:12:56.957523
Description:
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | HIGH | 7.1 |
| CVSS Version 3.x | MEDIUM | 6.5 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated | Statement |
|---|---|---|---|---|---|---|---|---|
| Debian 13 | python | 2.7 | 6.5 | MEDIUM | Released | CLSA-2025:1760370001 | 2025-10-13 16:37:46 | |
| Debian 13 | python | 3.8 | 6.5 | MEDIUM | Not Vulnerable | 2025-12-09 20:17:12 | ||
| Debian 13 | python | 3.7 | 6.5 | MEDIUM | Not Vulnerable | 2025-12-09 20:17:13 | ||
| EL 10 | python | 2.7 | 6.5 | MEDIUM | Released | CLSA-2025:1760370074 | 2025-10-13 16:38:58 | |
| EL 10 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2025-12-09 20:19:14 | ||
| EL 7 | python | 2.7 | 6.5 | MEDIUM | Released | CLSA-2025:1754040088 | 2025-08-02 00:15:55 | |
| EL 7 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2025-05-30 00:45:40 | ||
| EL 8 | python | 2.7 | 6.5 | MEDIUM | Released | CLSA-2025:1754039969 | 2025-08-02 00:15:54 | |
| EL 8 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2025-05-30 00:45:40 | ||
| EL 9 | python | 3.6 | 6.5 | MEDIUM | Already Fixed | 2025-05-30 00:59:43 |