Every CVE Search/ Get API key

CVE-2021-29063

ReDOS in Mpmath

7.5 HighFix available

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

4.18%Up 2.9 points since Jun 22, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Record
CVE-2021-29063
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-770
Updated
2026-11-02
CVE List No score

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Record
CVE-2021-29063
Updated
2026-11-02
EUVDEUVD-2021-0137 No score

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Record
EUVD-2021-0137
Updated
2026-11-03
GitHub AdvisoriesGHSA-f865-m6cq-j9vx 8.7

ReDOS in Mpmath

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called.

Record
GHSA-f865-m6cq-j9vx
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSV 7.5

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Record
CVE-2021-29063
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-29063 7.5

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Record
DEBIAN-CVE-2021-29063
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-f865-m6cq-j9vx 8.7

ReDOS in Mpmath

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called.

Record
GHSA-f865-m6cq-j9vx
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVUBUNTU-CVE-2021-29063 7.5

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Record
UBUNTU-CVE-2021-29063
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2021-0479 No score

Updated python-mpmath packages fix security vulnerability

Fix CVE-2021-29063 regular expression denial of service

Record
MGASA-2021-0479
Updated
2026-11-02
OSVopenSUSE-SU-2024:13280-1 No score

python310-mpmath-1.3.0-1.1 on GA media

These are all security issues fixed in the python310-mpmath-1.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13280-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12018-1 No score

python313-mpmath-1.3.0-3.4 on GA media

These are all security issues fixed in the python313-mpmath-1.3.0-3.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12018-1
Updated
2026-11-02
OSVPYSEC-2021-427 No score

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called.

Record
PYSEC-2021-427
Updated
2026-11-02
OSVUSN-7160-1 No score

mpmath vulnerability

It was discovered Mpmath incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause Mpmath to consume resources, leading to a denial of service.

Record
USN-7160-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mpmath
PyPI
 before 1.3.0
1.3.0
mpmath
Debian:12
 before 1.2.1-2
1.2.1-2
mpmath
Debian:13
 before 1.2.1-2
1.2.1-2
mpmath
Debian:14
 before 1.2.1-2
1.2.1-2
mpmath
PyPI
 before 1.3.0, plus listed versions
0.10.100.110.120.13
Show 17 moreShow less
0.140.150.160.170.180.190.20.30.40.50.60.70.80.91.0.01.1.01.2.1
1.3.0
python-mpmath
Mageia:8
 before 1.1.0-5.1.mga8
1.1.0-5.1.mga8
mpmath
Ubuntu:Pro:16.04:LTS
 before 0.19-3ubuntu0.1~esm1, plus listed versions
0.19-3
0.19-3ubuntu0.1~esm1
mpmath
Ubuntu:Pro:18.04:LTS
 before 1.0.0-1ubuntu0.1~esm1, plus listed versions
0.19-31.0.0-1
1.0.0-1ubuntu0.1~esm1
mpmath
Ubuntu:Pro:20.04:LTS
 before 1.1.0-2ubuntu0.1~esm1, plus listed versions
1.1.0-11.1.0-1build11.1.0-2
1.1.0-2ubuntu0.1~esm1
python-mpmath
openSUSE:Tumbleweed
 before 1.3.0-3.4
1.3.0-3.4

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-29063 is a high vulnerability (CVSS 7.5) in Mpmath, published June 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.18%, the 90th percentile. Fixed in mpmath 1.3.0.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open