CVE-2021-28861
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may le…
Published Aug 23, 2022 · updated Oct 14, 2026 · python python
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
Timeline
Detection, updates, and resolution for this record.
Aug 23, 2022 · NIST NVD
Detected
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
Oct 14, 2026 · NIST NVD
Updated
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
Affected
- cpe fedoraproject/fedora35
- cpe python/pythonversion unspecified
- cpe python/python3.11.0
Sources
- CVE.orgCVE-2021-28861
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-28861
30-day exploitation probability 2.5%
first.org - NIST NVDCVE-2021-28861
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation
nvd.nist.gov