CVE-2021-32837

published 2023-01-17

CVE-2021-32837: mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of…

Priority P3 51 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	python-mechanize	< python-mechanize 1:0.4.7-1 (bookworm)	python-mechanize 1:0.4.7-1 (bookworm)
mechanize_project	mechanize	< 0.4.6	0.4.6
mechanize_project	mechanize	>= 0 < 0.4.6	0.4.6
python-mechanize	mechanize	>= 0.4.6 < 0.4.6	0.4.6

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv 7.5 HIGH

vendor_debian 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1333