A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
Fix
Patch, vendor advisory and mitigation references on NVD 14
- https://bugs.python.org/issue44022 Exploit, Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25916 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/26503 Patch, Third Party Advisory
- https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html Patch, Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3737 Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://bugs.python.org/issue44022 Exploit, Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25916 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/26503 Patch, Third Party Advisory
- https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html Patch, Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3737 Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · python, redhat, fedoraprojectNVD modified 2026-10-14 10:17
Affected (CPE criteria) 24
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:netapp_xcp_smb:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:xcp_nfs:-:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:*
References 23
- https://bugs.python.org/issue44022 Exploit, Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25916 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/26503 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220407-0009/ Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3737 Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://bugs.python.org/issue44022 Exploit, Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25916 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/26503 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220407-0009/ Third Party Advisory
- https://ubuntu.com/security/CVE-2021-3737 Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html