{"id":"CVE-2021-40839","aliases":["GHSA-gh8j-2pgf-x458","PYSEC-2021-345"],"url":"https://o3.security/vulnerability/CVE-2021-40839","summary":"Infinite Loop in rencode","details":"The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\\x2f\\x7f), enabling a remote attack that consumes CPU and memory.","published":"2021-09-10T02:15:07.933Z","modified":"2026-07-08T06:01:18.168979734Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"rencode","fixedVersion":null}],"fix":{"url":"https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75","label":"aresch/rencode@572ff74"},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY/"},{"type":"ADVISORY","url":"https://pypi.org/project/rencode/#history"},{"type":"ADVISORY","url":"https://seclists.org/fulldisclosure/2021/Sep/16"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20211008-0001/"},{"type":"FIX","url":"https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75"},{"type":"FIX","url":"https://github.com/aresch/rencode/pull/29"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40839"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gh8j-2pgf-x458"},{"type":"PACKAGE","url":"https://github.com/aresch/rencode"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/rencode/PYSEC-2021-345.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20211008-0001"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:01:18.168979734Z"}}