CVE-2021-33503 An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Address URL Handling Vulnerabilities in Python Libraries CVE-2021-33503 affects urllib3 versions before 1.26.5, causing denial of service through catastrophic backtracking when processing URLs with excessive '@' characters. CVE-2023-26159 targets follow-redirects versions before 1.15.4, which improperly handle URLs, allowing attackers to redirect traffic to malicious sites, leading to potential phishing attacks. Both vulnerabilities require immediate attention from affected users. 2 sources 45

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (1)