CVE-2021-28861

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

CVSS 3.1

7.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-25)

CWE

CWE-601

Published

2022-08-23

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• fedoraproject:fedora
• python:python

References

• https://bugs.python.org/issue43223
• https://github.com/python/cpython/pull/24848
• https://github.com/python/cpython/pull/93879
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TRINJE3INWDVIHIABW4L2NP3RUSK7BJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LTSPFIULY2GZJN3QYNFVM4JSU6H4D6J/

Check your stackJSON