CVE-2026-77357: Python Unbounded Long Poll In Route

The route handler contains a polling loop with sleep() that lacks a timeout or maximum duration check. An attacker can supply parameters that prevent the loop exit condition from triggering, causing worker threads or connections to block indefinitely and exhausting server resources.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0Python
greprules fetch cve-2026-77357-python-unbounded-long-poll-in-route --engine opengrep

Description

The route handler contains a polling loop with sleep() that lacks a timeout or maximum duration check. An attacker can supply parameters that prevent the loop exit condition from triggering, causing worker threads or connections to block indefinitely and exhausting server resources.