{"id":"CVE-2021-23336","revision":"7e892ad53db546398ebaf0faa4c15e91","records":[{"revision":"7e892ad53db546398ebaf0faa4c15e91","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2021-23336","aliases":[],"title":"Web Cache Poisoning","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","state":0,"publishedAt":"2021-02-15T12:15:20.788+00:00","modifiedAt":"2026-10-14T11:34:52.993+00:00","affected":[{"ecosystem":"Vendor product","name":"python/cpython","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"n/a\",\n                    \"product\": \"python/cpython\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"unspecified\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"version\": \"unspecified\",\n                            \"lessThan\": \"3.6.13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"version\": \"3.7.0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"unspecified\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"version\": \"unspecified\",\n                            \"lessThan\": \"3.7.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"version\": \"3.8.0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"unspecified\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"version\": \"unspecified\",\n                            \"lessThan\": \"3.8.8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"version\": \"3.9.0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"unspecified\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"version\": \"unspecified\",\n                            \"lessThan\": \"3.9.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C","score":5.9,"severity":"MEDIUM"}],"references":["https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://github.com/python/cpython/pull/24297","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","http://www.openwall.com/lists/oss-security/2021/02/19/4","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://security.gentoo.org/glsa/202104-04","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://www.oracle.com/security-alerts/cpuApr2021.html","https://security.netapp.com/advisory/ntap-20210326-0004/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-23336","license":"CVE Program Terms of Use","key":"cve-program:CVE-2021-23336","identifiers":["CVE-2021-23336"]},"retained":false,"historicalAffected":[]}],"coverage":[]}