How severe is CVE-2010-3493?

CVE-2010-3493 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2010-3493 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2010-3493?

CVE-2010-3493 primarily affects Python. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2010-3493?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2010-3493 published?

CVE-2010-3493 was published on 2010-10-19 and last updated on 2026-06-16.

CVE-2010-3493

CVE-2010-3493 is a medium-severity vulnerability in Python with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-362.

Key facts

Severity: Medium (CVSS 2.0 base score 4.3)
EPSS exploit prediction: 3% (85th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-362
Affected product: Python
Published: 2010-10-19
Last modified: 2026-06-16

Description

Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, or the getpeername function having an ENOTCONN error, a related issue to CVE-2010-3492.

Frequently asked questions

What is CVE-2010-3493?: Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, or the getpeername function having an ENOTCONN error, a related issue to CVE-2010-3492.
How severe is CVE-2010-3493?: CVE-2010-3493 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2010-3493 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2010-3493?: CVE-2010-3493 primarily affects Python. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2010-3493?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2010-3493 published?: CVE-2010-3493 was published on 2010-10-19 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:a:python:python:3.1:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.2:alpha:*:*:*:*:*:*

More vulnerabilities in Python

CVE-2008-5031 — Critical (CVSS 10.0): Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown…
CVE-2022-48565 — Critical (CVSS 9.8): An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity…
CVE-2022-37454 — Critical (CVSS 9.8): The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow…
CVE-2021-29921 — Critical (CVSS 9.8): In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.…
CVE-2021-3177 — Critical (CVSS 9.8): Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code…
CVE-2020-27619 — Critical (CVSS 9.8): In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via…

All CVEs affecting Python →

Other CWE-362 (Race Condition) vulnerabilities

CVE-2022-27626 — Critical (CVSS 10.0): A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition')…
CVE-2015-8556 — Critical (CVSS 10.0): Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
CVE-2014-0703 — Critical (CVSS 10.0): Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition…
CVE-2010-1228 — Critical (CVSS 10.0): Multiple race conditions in the sandbox infrastructure in Google Chrome before 4.1.249.1036 have unspecified impact and…
CVE-2008-6598 — Critical (CVSS 10.0): Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic."
CVE-2026-46137 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential…

Browse all CWE-362 (Race Condition) vulnerabilities →