CVE-2021-3733There's a flaw in urllib's AbstractBasicAuthHandler class.
Updated under an hour ago ()
Does this affect you?
It affects Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP and 22 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
- CVSS
- 6.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-400
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Modified
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
python python python:python | before 3.6.14; from 3.7.0 before 3.7.11; from 3.8.0 before 3.8.10; from 3.9.0 before 3.9.5; 3.10.0 | NVD |
redhat codeready_linux_builder redhat:codeready_linux_builder | 8.0 | NVD |
redhat codeready_linux_builder_for_ibm_z_systems redhat:codeready_linux_builder_for_ibm_z_systems | 8.0 | NVD |
redhat codeready_linux_builder_for_power_little_endian redhat:codeready_linux_builder_for_power_little_endian | 8.0 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 8.0 | NVD |
redhat enterprise_linux_eus redhat:enterprise_linux_eus | 8.4 | NVD |
redhat enterprise_linux_for_ibm_z_systems redhat:enterprise_linux_for_ibm_z_systems | 8.0 | NVD |
redhat enterprise_linux_for_ibm_z_systems_eus redhat:enterprise_linux_for_ibm_z_systems_eus | 8.4 | NVD |
redhat enterprise_linux_for_power_little_endian redhat:enterprise_linux_for_power_little_endian | 8.0 | NVD |
redhat enterprise_linux_for_power_little_endian_eus redhat:enterprise_linux_for_power_little_endian_eus | 8.4 | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 8.4 | NVD |
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.4 | NVD |
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus | 8.4 | NVD |
redhat enterprise_linux_server_update_services_for_sap_solutions redhat:enterprise_linux_server_update_services_for_sap_solutions | 8.4 | NVD |
fedoraproject extra_packages_for_enterprise_linux fedoraproject:extra_packages_for_enterprise_linux | 7.0 | NVD |
fedoraproject fedora fedoraproject:fedora | 33; 34; 35; 36 | NVD |
netapp management_services_for_element_software_and_netapp_hci netapp:management_services_for_element_software_and_netapp_hci | all versions | NVD |
netapp ontap_select_deploy_administration_utility netapp:ontap_select_deploy_administration_utility | all versions | NVD |
netapp solidfire,_enterprise_sds_&_hci_storage_node netapp:solidfire,_enterprise_sds_&_hci_storage_node | all versions | NVD |
netapp hci_compute_node_firmware netapp:hci_compute_node_firmware | all versions | NVD |
References
- https://bugs.python.org/issue43075exploit, issue-tracking, patch, vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995234issue-tracking, third-party-advisory
- https://github.com/python/cpython/pull/24391patch, third-party-advisory
- https://ubuntu.com/security/CVE-2021-3733patch, third-party-advisory
- https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fbpatch, third-party-advisory
- https://security.netapp.com/advisory/ntap-20220407-0001/third-party-advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlmailing-list
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.htmlmailing-list
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.