CVE-2021-3177: Debian Linux

Critical severity, CVSS 9.8. EPSS: 23.3% chance of exploitation in the next 30 days.

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 22.2.0 only
• Oracle Communications Offline Mediation Controller: version 12.0.0.3.0 only
• Oracle Communications Pricing Design Center: version 12.0.0.3.0 only
• Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Python Python: from 3.6.0, up to and including 3.6.12; from 3.7.0, up to and including 3.7.9; from 3.8.0, up to and including 3.8.7; from 3.9.0, up to and including 3.9.1

Published 2021-01-19. Last modified 2026-06-17.