CVE-2021-3737

HIGH CVSS: 7.5 Published: 2022-03-04 Modified: 2026-06-17

Description

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Affected Platforms

Redhat Codeready Linux Builder For Ibm Z SystemsNetapp Ontap Select Deploy Administration UtilityCanonical Ubuntu LinuxRedhat Enterprise LinuxRedhat Enterprise Linux For Power Little EndianNetapp HciNetapp Netapp Xcp SmbFedoraproject FedoraOracle Communications Cloud Native Core PolicyRedhat Codeready Linux Builder

Weakness Type

CWE-835, CWE-400, CWE-835

References

https://bugs.python.org/issue44022
https://bugzilla.redhat.com/show_bug.cgi?id=1995162
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html