CVE-2021-32837: high-severity vulnerability in python-mechanize mechanize
mechanize vulnerable to ReDoS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A vulnerable regular expression in the mechanize library can be exploited by a malicious web server to crash the application by sending specially crafted responses. This happens because the regex takes too long to process certain input patterns, causing a denial of service.
The mechanize library prior to version 0.4.6 contains a ReDoS (Regular Expression Denial of Service) vulnerability in its regex pattern (CWE-1333). An attacker can craft a malicious HTTP response that triggers catastrophic backtracking in the regex engine, causing the application to hang or crash. The attack vector requires no authentication and only requires the application to process a response from a network-accessible server.