PT-2021-22973 · Pypi+3 · Encode+3

Antoine Martin · Published 2021-09-10 · Updated 2026-03-27 · CVE-2021-40839

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rencode package through 1.0.6 for Python

Description The issue allows an infinite loop in typecode decoding, such as via ;x2fx7f, enabling a remote attack that consumes CPU and memory.

Recommendations For rencode package versions through 1.0.6, consider updating to a version later than 1.0.6 to resolve the issue. As a temporary workaround, consider restricting the use of typecode decoding functionality until a patch is available.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2024-14538

CVE-2021-40839

GHSA-GH8J-2PGF-X458

MGASA-2022-0167

PYSEC-2021-345

Affected Products

Alt Linux

Debian

Red Os

Encode

References · 28

• https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75 · Patch
• https://github.com/aresch/rencode/pull/29 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-40839 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-40839 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0167.html · Security Note
• https://ubuntu.com/security/CVE-2021-40839 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40839 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-40839 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0167 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-40839 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gh8j-2pgf-x458 · Vendor Advisory