Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct

Summary

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Timeline

1. Jan 30, 2020, 12:00 AM UTCCVE published
2. Oct 7, 2026, 6:07 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 14, 2026, 8:40 AM UTCRecord last updated

Affected versions

• libpythonBitnami

  From 2.7.0 · fixed in 2.7.18; From 3.5.0 · fixed in 3.5.10; From 3.6.0 · fixed in 3.6.11; From 3.7.0 · fixed in 3.7.7; From 3.8.0 · fixed in 3.8.2

• pythonBitnami

  From 2.7.0 · fixed in 2.7.18; From 3.5.0 · fixed in 3.5.10; From 3.6.0 · fixed in 3.6.11; From 3.7.0 · fixed in 3.7.7; From 3.8.0 · fixed in 3.8.2

• python-minBitnami

  From 2.7.0 · fixed in 2.7.18; From 3.5.0 · fixed in 3.5.10; From 3.6.0 · fixed in 3.6.11; From 3.7.0 · fixed in 3.7.7; From 3.8.0 · fixed in 3.8.2

References 16