The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | urllib3 (PyPI) | 1.25.2 to before 1.25.8 | 1.25.8 | Patch available | GHSA-hmv2-79q8-fv6g |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- urllib3 (PyPI) Vendor— Affected 1.25.2 to before 1.25.8 Fixed in 1.25.8 Patch available GHSA-hmv2-79q8-fv6g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* | 1.25.2 – 1.25.7 | Vulnerable | python-pillow |
- cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 1.25.2 – 1.25.7 Vulnerable ·python-pillow
Remediation
- Fix · GHSA-hmv2-79q8-fv6g urllib3 (PyPI) Fixed in 1.25.8 Advisory →
Vendor assessments
Red Hat
Not affected: 12 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 15 (Stein)
- Red Hat Quay 3
- Red Hat Satellite 6
- Red Hat Software Collections
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7212
- 2026-10-03 Alias added: GHSA-hmv2-79q8-fv6g
References
Advisory 4
More python-pillow Urllib3 vulnerabilities
- TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
- TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
- TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
- TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
- TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
- TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
Sources
- CVE-2020-7212 · CVE Program
- CVE-2020-7212 · NVD
- FIRST EPSS
- GHSA-hmv2-79q8-fv6g · GitHub Advisory Database · CC BY 4.0
- CVE-2020-7212 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences