CVE-2021-23336

CVE-2021-23336 is a Web Cache Poisoning vulnerability affecting Python's urllib.parse.parse_qsl and urllib.parse.parse_qs functions across various versions of Python (before 3.6.13, 3.7.10, 3.8.8, and 3.9.2), as well as products like Debian, Django, Fedora, NetApp, and Oracle. This vulnerability, rated Medium severity (CVSS 5.9), allows attackers to use "parameter cloaking" by separating query parameters with a semicolon, causing proxies to misinterpret requests and cache malicious content as safe. While the attack complexity is high and user interaction is required, it can lead to a partial loss of integrity and high availability impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.