PSF-2019-14
Regular Expression Denial of Service in http.cookiejar
The regex http.cookiejar.LOOSE_HTTP_DATE_RE is vulnerable to regular
expression denial of service ("REDoS"). LOOSE_HTTP_DATE_RE.match() is
called when using http.cookiejar.CookieJar to parse Set-Cookie
headers returned by a HTTP server. Processing a response from a malicious
HTTP server can lead to extreme CPU usage and execution will be blocked
for a long time.
What each source reports
OSV No score
Regular Expression Denial of Service in http.cookiejar
The regex http.cookiejar.LOOSE_HTTP_DATE_RE is vulnerable to regular
expression denial of service ("REDoS"). LOOSE_HTTP_DATE_RE.match() is
called when using http.cookiejar.CookieJar to parse Set-Cookie
headers returned by a HTTP server. Processing a response from a malicious
HTTP server can lead to extreme CPU usage and execution will be blocked
for a long time.
- Record
PSF-2019-14- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
PSF-2019-14 is a vulnerability with no CVSS score yet, published November 14, 2019. No source lists public exploit code. No source names a fixed version.