7.5

CVE-2021-32837: mechanize vulnerable to ReDoS

Modified
AliasesMGASA-2023-0036openSUSE-SU-2023:0030-1GHSA-g3pv-pj5f-3hfq
Published 17-01-2023Last modified 22-12-2025

Vulnerability summary

CVE-2021-32837 is a high (CVSS 7.5) vulnerability in mechanize_project mechanize. EPSS estimates a 28.87% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
46/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
28.87%
0%100%
High · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2github

Timeline

  1. 17-01-2023
    PublishedVulnerability first disclosed.
  2. 22-12-2025
    Last modifiedVulnerability information updated.

Description

mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

28.87%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 28.87% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • githubUnverified

    Ghsl 2021 108 Python Mechanize Mechanize

    Maturity: poc

  • githubUnverified

    Mechanize

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Opensuse2 products
  • python-mechanize&distro=openSUSE Leap 15.4< 0.4.8-bp154.2.3.1
  • python-mechanize&distro=openSUSE Tumbleweed< 0.4.10-1.4
Debian1 product
  • python-mechanize< 1:0.2.5-3+deb10u1 | < 1:0.4.5-2+deb11u1 | < 1:0.4.7-1
Mageia1 product
  • python-mechanize< 0.4.6-1.mga8
Mechanize_project1 product
PyPI1 product
  • mechanize< dd05334448e9f39814bab044d2eaa5ef69b410d6 | < 0.4.6
Python-mechanize1 product
Suse1 product
  • python-mechanize&distro=SUSE Package Hub 15 SP4< 0.4.8-bp154.2.3.1
Ubuntu1 product
  • python-mechanizeAll versions (No fix recorded)

8 vendors · 9 products

References

21 links
Show all 21 references