onyx --cves cve-2021-3737
CVE-2021-3737
- score
- <0.1
- cvss
- 7.5
- epss
- 13.2%
- published
- 2022-03-04
- kev added
- —
- first seen
Python contains an improperly handled HTTP response caused by a flaw in the HTTP client code, letting remote attackers controlling the HTTP server cause client scripts to enter an infinite loop, exploit requires attacker to control the server.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 13
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://bugs.python.org/issue44022
- https://github.com/python/cpython/pull/25916
- https://github.com/python/cpython/pull/26503
- https://security.netapp.com/advisory/ntap-20220407-0009/
- https://ubuntu.com/security/CVE-2021-3737
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1995162
- https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html