CVE-2021-28861: Fedoraproject Fedora

High severity, CVSS 7.4. EPSS: 2.5% chance of exploitation in the next 30 days.

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

Affected products

• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Python Python: from 3.0.0, before 3.7.14 (fixed in 3.7.14); from 3.8.0, before 3.8.14 (fixed in 3.8.14); from 3.9.0, before 3.9.14 (fixed in 3.9.14); from 3.10.0, before 3.10.6 (fixed in 3.10.6); version 3.11.0 only

Published 2022-08-23. Last modified 2026-06-17.