CVE-2021-33503: Python Urllib3 DOS Vulnerability

CVE-2021-33503 Overview

CVE-2021-33503 is a Regular Expression Denial of Service (ReDoS) vulnerability discovered in Python's urllib3 library before version 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service. This vulnerability can be triggered if a malicious URL is passed as a parameter or if an application follows an HTTP redirect to a crafted URL.

Critical Impact

Applications using vulnerable versions of urllib3 can be rendered unresponsive through crafted URLs containing multiple @ characters, leading to CPU exhaustion and denial of service conditions.

Affected Products

• Python urllib3 (versions before 1.26.5)
• Fedora Project Fedora 33 and 34
• Oracle Enterprise Manager Ops Center 12.4.0.0
• Oracle Instantis EnterpriseTrack 17.1, 17.2, and 17.3
• Oracle ZFS Storage Appliance Kit 8.8

Discovery Timeline

• June 29, 2021 - CVE-2021-33503 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-33503

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The flaw exists in the URL parsing logic within urllib3's url.py module. The authority component of a URL (the part between :// and the path) is parsed using a regular expression pattern that attempts to identify userinfo, host, and port segments. When a URL contains many @ characters, the regex engine experiences exponential time complexity due to catastrophic backtracking, consuming excessive CPU resources.

The vulnerability is particularly dangerous because urllib3 is one of the most widely used HTTP client libraries in the Python ecosystem and is a dependency for many popular packages including requests. An attacker can exploit this by either directly providing a malicious URL to an application or by controlling a server that issues HTTP redirects to crafted URLs.

Root Cause

The root cause lies in the SUBAUTHORITY_PAT regular expression pattern used to parse the authority component of URLs. The original pattern ^(?:(.*)@)?(%s|%s|%s)(?::([0-9]{0,5}))?$ uses a greedy (.*) capture group to match the userinfo portion before the @ symbol. When multiple @ characters are present, the regex engine backtracks exponentially trying different combinations of where to split the userinfo from the host portion.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by:

1. Sending a crafted URL directly to an application that processes URLs using urllib3
2. Hosting a malicious server that redirects requests to a URL containing many @ characters
3. Injecting malicious URLs into any input field that gets processed by urllib3

The following patch was applied to fix the vulnerability by restructuring how the authority component is parsed:

 BRACELESS_IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT[2:-2] + "$")
 ZONE_ID_RE = re.compile("(" + ZONE_ID_PAT + r")\]$")
 
-SUBAUTHORITY_PAT = (u"^(?:(.*)@)?(%s|%s|%s)(?::([0-9]{0,5}))?$") % (
+_HOST_PORT_PAT = ("^(%s|%s|%s)(?::([0-9]{0,5}))?$") % (
     REG_NAME_PAT,
     IPV4_PAT,
     IPV6_ADDRZ_PAT,
 )
-SUBAUTHORITY_RE = re.compile(SUBAUTHORITY_PAT, re.UNICODE | re.DOTALL)
+_HOST_PORT_RE = re.compile(_HOST_PORT_PAT, re.UNICODE | re.DOTALL)
 
 UNRESERVED_CHARS = set(
     "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-~"

Source: GitHub Commit

The fix eliminates the problematic greedy userinfo capture group by splitting the authority parsing into separate operations, first handling the @ delimiter through string operations rather than regex, then applying the regex only to the host:port portion.

Detection Methods for CVE-2021-33503

Indicators of Compromise

• Unusual CPU spikes on application servers processing HTTP requests
• Application timeouts or hangs when processing URL-related operations
• Log entries showing URLs with excessive @ characters in the authority component
• Slow response times from services that rely on urllib3 for HTTP operations

Detection Strategies

• Monitor application performance metrics for unexpected CPU usage patterns during URL processing
• Implement input validation to detect and reject URLs with abnormal numbers of @ characters before they reach urllib3
• Use dependency scanning tools to identify urllib3 versions prior to 1.26.5 in your environment
• Deploy application-level monitoring to detect regex processing timeouts

Monitoring Recommendations

• Set up alerts for process CPU utilization exceeding normal thresholds on systems running Python applications
• Monitor Python application logs for timeout exceptions related to HTTP client operations
• Implement network monitoring to detect potential redirect chains pointing to malicious URLs
• Use SIEM rules to correlate multiple denial of service indicators across application infrastructure

How to Mitigate CVE-2021-33503

Immediate Actions Required

• Upgrade urllib3 to version 1.26.5 or later immediately across all Python environments
• Audit all applications and dependencies that use urllib3 to ensure complete coverage
• Review any URL processing logic for additional input validation opportunities
• Consider implementing request timeouts as a defense-in-depth measure

Patch Information

The vulnerability is fixed in urllib3 version 1.26.5 and later. The patch modifies the URL parsing approach by removing the vulnerable regex pattern and implementing a more efficient string-based parsing strategy for the authority component. The fix is available through the GitHub commit. Additional vendor-specific patches are available from Oracle Security Alerts for affected Oracle products.

Workarounds

• Implement URL validation at the application layer to reject URLs containing more than one @ character in the authority component
• Use web application firewalls (WAF) to filter requests containing potentially malicious URL patterns
• Configure request timeouts to limit the impact of potential ReDoS attacks on application availability
• Consider implementing rate limiting on endpoints that process user-supplied URLs

# Upgrade urllib3 to patched version
pip install --upgrade "urllib3>=1.26.5"

# Verify installed version
pip show urllib3 | grep Version

# For virtual environments, update requirements.txt
echo "urllib3>=1.26.5" >> requirements.txt
pip install -r requirements.txt