CVE-2021-21240
HIGHhttplib2 < 0.19.0 - Denial of Service via Malicious WWW-Authenticate Header
Title source: llmDescription
httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.
References (4)
Core 4
Core References
Exploit, Mitigation, Third Party Advisory x_refsource_confirm
https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m
Patch, Third Party Advisory x_refsource_misc
https://github.com/httplib2/httplib2/pull/182
Patch, Third Party Advisory x_refsource_misc
https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc
Product, Third Party Advisory x_refsource_misc
https://pypi.org/project/httplib2
Scores
CVSS v3
7.5
EPSS
0.0388
EPSS Percentile
88.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (2)
httplib2_project/httplib2
< 0.19.0
pypi/httplib2
0 - 0.19.0PyPI
Published
Feb 08, 2021
Tracked Since
Feb 18, 2026