CVE-2020-7212

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

• CWE-400

• https://github.com/urllib3/urllib3/blob/master/CHANGES.rstRelease Notes, Third Party Advisory
• https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221aPatch, Third Party Advisory
• https://pypi.org/project/urllib3/1.25.8/Release Notes, Vendor Advisory
• https://github.com/urllib3/urllib3/blob/master/CHANGES.rstRelease Notes, Third Party Advisory
• https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221aPatch, Third Party Advisory
• https://pypi.org/project/urllib3/1.25.8/Release Notes, Vendor Advisory

Published

Mar 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7206HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and ear…9.8
• CVE-2020-7207A local elevation of privilege using physical access securit…6.8
• CVE-2020-7208LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is …6.1
• CVE-2020-7209LinuxKI v6.0-1 and earlier is vulnerable to an remote code e…9.8
• CVE-2020-7210Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete us…4.3
• CVE-2020-7211tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not pr…7.5
• CVE-2020-7213Parallels 13 uses cleartext HTTP as part of the update proce…7.5
• CVE-2020-7215An issue was discovered in Gallagher Command Centre 7.x befo…5.5
• CVE-2020-7216An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.…7.5
• CVE-2020-7217An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE…7.5
• CVE-2020-7218HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC s…7.5
• CVE-2020-7219HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC …7.5