{"id":"PSF-2019-14","aliases":[],"status":"published","title":"Regular Expression Denial of Service in http.cookiejar","description":"The regex ``http.cookiejar.LOOSE_HTTP_DATE_RE`` is vulnerable to regular\nexpression denial of service (\"REDoS\"). ``LOOSE_HTTP_DATE_RE.match()`` is\ncalled when using ``http.cookiejar.CookieJar`` to parse ``Set-Cookie``\nheaders returned by a HTTP server. Processing a response from a malicious\nHTTP server can lead to extreme CPU usage and execution will be blocked\nfor a long time.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-11-14T00:00:00Z","modified":"2025-10-09T01:02:32Z","references":[{"url":"https://access.redhat.com/security/cve/CVE-2019-16935","tags":["advisory"]},{"url":"https://bugs.python.org/issue38804","tags":["report"]}],"sources":{"osv":[{"id":"PSF-2019-14","title":"Regular Expression Denial of Service in http.cookiejar","description":"The regex ``http.cookiejar.LOOSE_HTTP_DATE_RE`` is vulnerable to regular\nexpression denial of service (\"REDoS\"). ``LOOSE_HTTP_DATE_RE.match()`` is\ncalled when using ``http.cookiejar.CookieJar`` to parse ``Set-Cookie``\nheaders returned by a HTTP server. Processing a response from a malicious\nHTTP server can lead to extreme CPU usage and execution will be blocked\nfor a long time.\n","status":"published","published":"2019-11-14T00:00:00Z","modified":"2025-10-09T01:02:32.615303Z","updated_at":"2026-11-02T15:52:50.263679Z"}]}}