{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"rencode","cve_ids":["CVE-2021-40839"],"ecosystem":"PyPI","epss":0.0552,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-gh8j-2pgf-x458","id":"tcs_01M5KGCG16XMN56FPSEZZB5TFQ","modified_at":"2025-10-09T07:29:23.400797Z","published_at":"2021-09-10T02:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-345","https://github.com/aresch/rencode/pull/29","https://pypi.org/project/rencode/#history","https://seclists.org/fulldisclosure/2021/Sep/16","https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75","https://github.com/advisories/GHSA-gh8j-2pgf-x458"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-345","url":"https://osv.dev/vulnerability/PYSEC-2021-345"}],"summary":"The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\\x2f\\x7f), enabling a remote attack that consumes CPU and memory."}