CVE-2021-33503

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

• CWE-400

• https://github.com/advisories/GHSA-q2q7-5pp4-w6pgThird Party Advisory
• https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ecPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SCV7ZNAHS3E6PBFLJGENCDRDRWRZZ6W/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMUGWEAUYGGHTPPXT6YBD53WYXQGVV73/
• https://security.gentoo.org/glsa/202107-36Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://github.com/advisories/GHSA-q2q7-5pp4-w6pgThird Party Advisory
• https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ecPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SCV7ZNAHS3E6PBFLJGENCDRDRWRZZ6W/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMUGWEAUYGGHTPPXT6YBD53WYXQGVV73/
• https://security.gentoo.org/glsa/202107-36Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Jun 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33498Pexip Infinity before 26 allows remote denial of service bec…7.5
• CVE-2021-33499Pexip Infinity before 26 allows remote denial of service bec…7.5
• CVE-2021-3350deleteaccount.php in the Delete Account plugin 1.4 for MyBB …6.1
• CVE-2021-33500PuTTY before 0.75 on Windows allows remote servers to cause …7.5
• CVE-2021-33501Overwolf Client 0.169.0.22 allows XSS, with resultant Remote…9.6
• CVE-2021-33502The normalize-url package before 4.5.1, 5.x before 5.3.1, an…7.5
• CVE-2021-33504Couchbase Server before 7.1.0 has Incorrect Access Control.4.9
• CVE-2021-33505A local malicious user can circumvent the Falco detection en…7.8
• CVE-2021-33506jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not …7.5
• CVE-2021-33507Zope Products.CMFCore before 2.5.1 and Products.PluggableAut…6.1
• CVE-2021-33508Plone through 5.2.4 allows XSS via a full name that is misha…5.4
• CVE-2021-33509Plone through 5.2.4 allows remote authenticated managers to …9.9