-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from an inefficient regex pattern in AbstractBasicAuthHandler's authentication header parsing. The commit dd05334 explicitly replaced this regex with a more efficient version from Python 3.9's urllib, and added tests verifying rejection of malicious inputs like ',,,,,,...'. The regex's structure (particularly the '(?:.,)' portion) made it susceptible to ReDoS when processing headers with many unprocessed comma separators, as demonstrated in the test case.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mechanize | pip | < 0.4.6 | 0.4.6 |
Ongoing coverage of React2Shell