CVE-2021-3737

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-04 · updated 2026-10-14
Weakness: CWE-835

Description

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04, 21.04
Fedoraproject Fedora: 33, 34
NetApp Hci: all versions
NetApp Management Services For Element Software: all versions
Netapp Xcp Smb: all versions
NetApp ONTAP Select Deploy administration utility: all versions
NetApp Xcp Nfs: all versions
Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
Oracle Communications Cloud Native Core Network Exposure Function: 22.1.1
Oracle Communications Cloud Native Core Policy: 22.2.0
Python: from 3.6.0 before 3.6.14; from 3.7.0 before 3.7.11; from 3.8.0 before 3.8.11; from 3.9.0 before 3.9.6 — fixed in 3.6.14, 3.7.11, 3.8.11, 3.9.6
RedHat Codeready Linux Builder: 8.0
RedHat Codeready Linux Builder For Ibm Z Systems: 8.0
RedHat Codeready Linux Builder For Power Little Endian: 8.0
Red Hat Enterprise Linux: 6.0, 7.0, 8.0
RedHat Enterprise Linux For Ibm Z Systems: 8.0
RedHat Enterprise Linux For Power Little Endian: 8.0

How to fix

Upgrade to a fixed version: Python 3.6.14, 3.7.11, 3.8.11, 3.9.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3737 or the next vulnerability affects your stack