CVE-2021-40839

Published: Sep 10, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.

Affected (3)

Products: Rencode Project: Rencode · Fedoraproject: Fedora

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Rencode Project Rencode	Up to 1.0.6

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Related CWEs

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (14)

https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/aresch/rencode/pull/29

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY/

Source: cve@mitre.org

https://pypi.org/project/rencode/#history

Source: cve@mitre.org

Third Party Advisory

https://seclists.org/fulldisclosure/2021/Sep/16

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20211008-0001/

Source: cve@mitre.org

Third Party Advisory

https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75