CVEs-PoC/2021/CVE-2021-3737.md

### [CVE-2021-3737](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737)
![](https://img.shields.io/static/v1?label=Product&message=python&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20python%20v3.6.14%2C%20python%20v3.7.11%2C%20python%20v3.8.11%2C%20python%20v3.9.6%2C%20python%20v3.10.0b2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-835%20-%20Loop%20with%20Unreachable%20Exit%20Condition%20('Infinite%20Loop')%2C%20CWE-400%20-%20Uncontrolled%20Resource%20Consumption&color=brightgreen)

### Description

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

### POC

#### Reference
- https://github.com/python/cpython/pull/25916
- https://www.oracle.com/security-alerts/cpujul2022.html

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/GitHubForSnap/matrix-commander-gael
- https://github.com/NathanielAPawluk/sec-buddy