---
id: CVE-2021-3737
title: A flaw was found in python
summary: >-
  A flaw was found in python. An improperly handled HTTP response in the HTTP
  client code of python may allow a remote attacker, who controls the HTTP
  server, to make the client script enter an infinite loop, consuming CPU time.
  The highes…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
  - CWE-400
  - CWE-835
vendor: python
product: python
affected:
  - 'python >= 3.6.0, < 3.6.14'
  - 'python >= 3.7.0, < 3.7.11'
  - 'python >= 3.8.0, < 3.8.11'
  - 'python >= 3.9.0, < 3.9.6'
  - codeready_linux_builder = 8.0
  - codeready_linux_builder_for_ibm_z_systems = 8.0
  - codeready_linux_builder_for_power_little_endian = 8.0
  - enterprise_linux = 6.0
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
  - enterprise_linux_for_ibm_z_systems = 8.0
  - enterprise_linux_for_power_little_endian = 8.0
  - fedora = 33
  - fedora = 34
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 20.04
  - ubuntu_linux = 21.04
  - hci
  - management_services_for_element_software
  - netapp_xcp_smb
  - ontap_select_deploy_administration_utility
  - xcp_nfs
  - communications_cloud_native_core_binding_support_function = 22.1.3
  - communications_cloud_native_core_network_exposure_function = 22.1.1
  - communications_cloud_native_core_policy = 22.2.0
patched:
  - python 3.9.6
published: '2022-03-04'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T10:17:47.917'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-3737'
references:
  - url: 'https://bugs.python.org/issue44022'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1995162'
    label: secalert@redhat.com
  - url: 'https://github.com/python/cpython/pull/25916'
    label: secalert@redhat.com
  - url: 'https://github.com/python/cpython/pull/26503'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html'
    label: secalert@redhat.com
  - url: 'https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html'
    label: secalert@redhat.com
  - url: 'https://security.netapp.com/advisory/ntap-20220407-0009/'
    label: secalert@redhat.com
  - url: 'https://ubuntu.com/security/CVE-2021-3737'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: secalert@redhat.com
  - url: 'https://bugs.python.org/issue44022'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1995162'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/python/cpython/pull/25916'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/python/cpython/pull/26503'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20220407-0009/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://ubuntu.com/security/CVE-2021-3737'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.11586
epssPercentile: 0.95961
ingestedAt: '2026-10-14T10:25:41.192Z'
---

## Overview

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

## Affected

- `python >= 3.6.0, < 3.6.14`
- `python >= 3.7.0, < 3.7.11`
- `python >= 3.8.0, < 3.8.11`
- `python >= 3.9.0, < 3.9.6`
- `codeready_linux_builder = 8.0`
- `codeready_linux_builder_for_ibm_z_systems = 8.0`
- `codeready_linux_builder_for_power_little_endian = 8.0`
- `enterprise_linux = 6.0`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`
- `enterprise_linux_for_ibm_z_systems = 8.0`
- `enterprise_linux_for_power_little_endian = 8.0`
- `fedora = 33`
- `fedora = 34`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 20.04`
- `ubuntu_linux = 21.04`
- `hci`
- `management_services_for_element_software`
- `netapp_xcp_smb`
- `ontap_select_deploy_administration_utility`
- `xcp_nfs`
- `communications_cloud_native_core_binding_support_function = 22.1.3`
- `communications_cloud_native_core_network_exposure_function = 22.1.1`
- `communications_cloud_native_core_policy = 22.2.0`

## Remediation

Upgrade past the affected range:

- `python 3.9.6`