Infinite loop in python
Priority MEDIUM 53CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-835.
Summary
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.13166 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 5 advisoriesRed Hat: 6 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | python | Fixed in python v3.6.14, python v3.7.11, python v3.8.11, python v3.9.6, python v3.10.0b2 | — | No fix listed | CNA |
- python Vendor— Affected Fixed in python v3.6.14, python v3.7.11, python v3.8.11, python v3.9.6, python v3.10.0b2 Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | 3.6.0 to before 3.6.14; 3.7.0 to before 3.7.11; 3.8.0 to before 3.8.11; 3.9.0 to before 3.9.6 | Vulnerable | python-pillow |
| cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions 3.6.0 to before 3.6.14; 3.7.0 to before 3.7.11; 3.8.0 to before 3.8.11; 3.9.0 to before 3.9.6 Vulnerable ·python-pillow
- cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:* | 21.04 | Vulnerable | Canonical |
| cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:netapp_xcp_smb:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:xcp_nfs:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* | 22.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:* | 22.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:* | 22.2.0 | Vulnerable | Oracle |
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:* Versions 21.04 Vulnerable ·Canonical
- cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:netapp_xcp_smb:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:xcp_nfs:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:* Versions 22.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:* Versions 22.2.0 Vulnerable ·Oracle
Remediation
Red Hat 5 advisories
- RHSA-2022:1986 Released 2022-05-10 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-45.el8, platform-python-debug-3.6.8-45.el8, platform-python-devel-3.6.8-45.el8 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-45.el8, python3-3.6.8-45.el8, python3-libs-3.6.8-45.el8 +1
- RHSA-2022:1821 Released 2022-05-10 · Red Hat rating Moderatepython27:2.7 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-10.module+el8.5.0+11014+88fc0d0b.noarch::python27:2.7 +47
- RHSA-2022:1764 Released 2022-05-10 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
- Red Hat Enterprise Linux CRB (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
Show 2 more Red Hat advisories
- RHSA-2022:1663 Released 2022-05-02 · Red Hat rating Moderatepython27-python and python27-python-pip security update
- Red Hat Software Collections for RHEL Workstation(v. 7) python27-python-2.7.18-4.el7, python27-python-debug-2.7.18-4.el7, python27-python-devel-2.7.18-4.el7 +4
- Red Hat Software Collections for RHEL(v. 7) python27-python-2.7.18-4.el7, python27-python-debug-2.7.18-4.el7, python27-python-devel-2.7.18-4.el7 +4
- RHSA-2021:4160 Released 2021-11-09 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat CodeReady Linux Builder (v. 8) Cython-0.29.21-5.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pybind11-2.6.1-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9 +33
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2021:4160 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4160, RHSA-2022:1764, RHSA-2022:1821, RHSA-2022:1986 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2022:1986 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2022:1764 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:1663 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:1663 |
Not affected: 4 products
- Red Hat Enterprise Linux 9
- Red Hat Software Collections
- Red Hat Software Collections for RHEL Workstation(v. 7)
- Red Hat Software Collections for RHEL(v. 7)
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3737
- 2026-10-03 Alias added: GHSA-hr7v-m862-8hh8
References
Exploit 1
Patch 6
- https://github.com/python/cpython/pull/25916
- https://bugzilla.redhat.com/show_bug.cgi?id=1995162
- https://github.com/python/cpython/pull/26503
- https://ubuntu.com/security/CVE-2021-3737
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html
Sources
- CVE-2021-3737 · CVE Program
- CVE-2021-3737 · NVD
- FIRST EPSS
- GHSA-hr7v-m862-8hh8 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3737 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences