CVE-2020-8492: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 6.6% chance of exploitation in the next 30 days.

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.10 only; version 20.04 only
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Opensuse Leap: version 15.1 only
• Python Python: from 2.7.0, up to and including 2.7.17; from 3.5.0, up to and including 3.5.9; from 3.6.0, up to and including 3.6.10; from 3.7.0, up to and including 3.7.6; from 3.8.0, up to and including 3.8.1

Published 2020-01-30. Last modified 2026-10-07.