CVE-2021-3737: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days.

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 20.04 only; version 21.04 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Netapp Hci: affected versions not specified
• Netapp Management Services For Element Software: affected versions not specified
• Netapp Netapp Xcp SMB: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Netapp Xcp Nfs: affected versions not specified
• Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
• Oracle Communications Cloud Native Core Network Exposure Function: version 22.1.1 only
• Oracle Communications Cloud Native Core Policy: version 22.2.0 only
• Python Python: from 3.6.0, before 3.6.14 (fixed in 3.6.14); from 3.7.0, before 3.7.11 (fixed in 3.7.11); from 3.8.0, before 3.8.11 (fixed in 3.8.11); from 3.9.0, before 3.9.6 (fixed in 3.9.6)
• Red Hat Codeready Linux Builder: version 8.0 only
• Red Hat Codeready Linux Builder For IBM Z Systems: version 8.0 only
• Red Hat Codeready Linux Builder For Power Little Endian: version 8.0 only
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only; version 8.0 only
• Red Hat Enterprise Linux For IBM Z Systems: version 8.0 only
• Red Hat Enterprise Linux For Power Little Endian: version 8.0 only

Published 2022-03-04. Last modified 2026-06-17.