UpHeron
All vulnerabilities

Servers and applications

CVE-2021-3177

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Severity
Critical 9.8
Published
19 Jan 2021
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • From 3.6.0 up to 3.6.12
  • From 3.7.0 up to 3.7.9
  • From 3.8.0 up to 3.8.7
  • From 3.9.0 up to 3.9.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-3177
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-3177