CVE-2022-36087
python-oauthlib: DoS when attacker provides malicious IPV6 URI
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 9, 2022
Updated · November 4, 2026
Description
A flaw was found in python-oauthlib. This flaw allows an attacker providing a malicious redirect URI to cause a denial of service to OAuthLib's web application.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
The redirect_uri can be verified in the web toolkit before OAuthLib is called. Check to see if : is present to reject the request can prevent the denial of service, assuming no port or IPv6 is fundamentally required.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-601 · URL Redirection to Untrusted Site