Back
CVE-2022-36087
OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI
Medium5.7EPSS 1.8%
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.8% · top 22% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.7.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPIoauthlibGHSA-3pgj-pg6c-r5p7 (opens in a new tab)
References (9)
- https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7 (opens in a new tab)x_transferred
- https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd (opens in a new tab)x_transferred
- https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py (opens in a new tab)x_transferred
- https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 (opens in a new tab)x_transferred
- https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1 (opens in a new tab)x_transferred
- FEDORA-2022-5a74a5eea7 (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2023-da094276a2 (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2023-49ded4c9a5 (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2023-5ab7049a59 (opens in a new tab)vendor-advisoryx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-3pgj-pg6c-r5p7 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-36087)Record last updated .