CVE-2020-7212: python urllib3 Uncontrolled Resource Consumption
Vulnerability summary
CVE-2020-7212 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in python urllib3. EPSS estimates a 3.37% chance of exploitation in the next 30 days, higher than 88.6% of scored vulnerabilities.
Timeline
- 06-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.37%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.37% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python-urllib3< 1.25.8-1
PyPI1 product
- urllib3< a74c9cfbaed9f811e7563cfc3dce894928e0221a | ≥ 1.25.2, < 1.25.8
Python1 product
- urllib3≥ 1.25.2, ≤ 1.25.7
Ubuntu1 product
- python-urllib3< 1.25.8-2
4 vendors · 4 products
References
12 links- github.com/urllib3/urllib3/blob/master/CHANGES.rstX Refsource MISCWEBREPORTRelease NotesThird Party Advisory
- github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221aX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
- github.com/urllib3/urllib3PACKAGE
