mechanize vulnerable to ReDoS

A vulnerable regular expression in the mechanize library can be exploited by a malicious web server to crash the application by sending specially crafted responses. This happens because the regex takes too long to process certain input patterns, causing a denial of service.

The mechanize library prior to version 0.4.6 contains a ReDoS (Regular Expression Denial of Service) vulnerability in its regex pattern (CWE-1333). An attacker can craft a malicious HTTP response that triggers catastrophic backtracking in the regex engine, causing the application to hang or crash. The attack vector requires no authentication and only requires the application to process a response from a network-accessible server.