Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-3733

25
FAUCET Score

CVE-2021-3733 is a Regular Expression Denial of Service (ReDOS) vulnerability in urllib's AbstractBasicAuthHandler, affecting products like fedoraproject, netapp, python, and redhat. An attacker controlling a malicious HTTP server can trigger a denial of service in a connecting client via a specially crafted authentication payload. With a CVSS score of 6.5 (Medium), this flaw primarily impacts application availability and requires low privileges and no user interaction. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.6.14CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.7.0, < 3.7.11CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.8.0, < 3.8.10CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.9.0, < 3.9.5CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
3.10.0CPE matchmatch criteria
cpe:2.3:a:python:python:3.10.0:-:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
4.84%
Probability of exploitation in next 30 days
EPSS Percentile
91.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0484 is in the 97th percentile among its peer group of 21,951 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (30)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 18878-16820Fixed in: 2.7.18-10
microsoftpatch availablevia msrc
Product: cm1 python2 2.7.18-10 on CBL Mariner 1.0Fixed in: 2.7.18-10
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 2.7.18-10
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 2.7.18-10
nodejspatch availablevia llm_extracted
View patch
pjsippatch availablevia llm_extracted
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python27:2.7-8060020220210185952.8cdc2268
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python3-0:3.6.8-39.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-babel-0:2.7.0-12.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-0:3.8.11-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-cryptography-0:2.8-5.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-jinja2-0:2.10.3-6.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-lxml-0:4.4.1-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-pip-0:19.3.1-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-urllib3-0:1.25.7-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-0:2.7.18-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python38-babel-0:2.7.0-12.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python38-python-0:3.8.11-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python38-python-cryptography-0:2.8-5.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python38-python-jinja2-0:2.10.3-6.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python38-python-lxml-0:4.4.1-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python38-python-pip-0:19.3.1-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python38-python-urllib3-0:1.25.7-7.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python39-devel:3.9-8050020210811100211.d428a79b
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python38-devel:3.8-8060020220120164031.5294be16
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python39:3.9-8050020210811100211.d428a79b
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python38:3.8-8060020220120164031.5294be16
View patch
ubuntupatch availablevia nvd_reference
View patch
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python36:3.6/python36

Vendor Advisories (5)

nodejsllm-nodejs-302528ae26f0d946CRITICAL

HP ThinPro 8.1 SP4 Security Updates

Oct 29, 2024
pjsipllm-pjsip-7ba3ec379210ac70CRITICAL

HP ThinPro 8.1 SP4 Security Updates

Oct 29, 2024
microsoft2022-Jun/CVE-2021-3733

CVE-2021-3733

Jun 14, 2022
microsoft2022-Mar/CVE-2021-3733Moderate

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Mar 8, 2022
redhatCVE-2021-3733Moderate

python: urllib: Regular expression DoS in AbstractBasicAuthHandler

Aug 10, 2021

References

lists.debian.org / debian-lts-announce/2024/12/msg00000.html
bugs.python.org / issue43075
ExploitIssue TrackingPatchVendor Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingThird Party Advisory
github.com / python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb
PatchThird Party Advisory
github.com / python/cpython/pull/24391
PatchThird Party Advisory
lists.debian.org / debian-lts-announce/2023/05/msg00024.html
lists.debian.org / debian-lts-announce/2023/06/msg00039.html
security.netapp.com / advisory/ntap-20220407-0001
Third Party Advisory
ubuntu.com / security/CVE-2021-3733
PatchThird Party Advisory