{"id":"PYSEC-2020-149","details":"The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).","aliases":["CVE-2020-7212","GHSA-hmv2-79q8-fv6g"],"modified":"2023-11-08T04:03:58.967412Z","published":"2020-03-06T20:15:00Z","references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/blob/master/CHANGES.rst"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3/1.25.8/"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221a"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hmv2-79q8-fv6g"}],"affected":[{"package":{"name":"urllib3","ecosystem":"PyPI","purl":"pkg:pypi/urllib3"},"ranges":[{"type":"GIT","repo":"https://github.com/urllib3/urllib3","events":[{"introduced":"0"},{"fixed":"a74c9cfbaed9f811e7563cfc3dce894928e0221a"}]},{"type":"ECOSYSTEM","events":[{"introduced":"1.25.2"},{"fixed":"1.25.8"}]}],"versions":["1.25.2","1.25.3","1.25.4","1.25.5","1.25.6","1.25.7"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/urllib3/PYSEC-2020-149.yaml"}}],"schema_version":"1.7.3"}