There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authen…

{
                    "vendor": "n/a",
                    "product": "python",
                    "versions": [
                        {
                            "version": "Fixed in python v3.6.14, python v3.7.11, python v3.8.10, python v3.9.5.",
                            "status": "affected"
                        }
                    ]
                }