Log in Start free

Vulnerability · Published Dec 1, 2025 · Assigned by PSF

CVE-2025-13837Out-of-memory when loading Plist

Low 2.1

In plain English

A low-severity uncontrolled resource consumption in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)0.2%top 84.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python-unversioned-command3.12.13-2.el10_2ALSA-2026:19064
AlmaLinux:10python33.12.13-2.el10_2ALSA-2026:19064
AlmaLinux:10python3-debug3.12.13-2.el10_2ALSA-2026:19064
AlmaLinux:10python3-devel3.12.13-2.el10_2ALSA-2026:19064
AlmaLinux:10python3-idle3.12.13-2.el10_2ALSA-2026:19064
AlmaLinux:10python3-libs3.12.13-2.el10_2ALSA-2026:19064
AlmaLinux:10python3-test3.12.13-2.el10_2ALSA-2026:19064
AlmaLinux:10python3-tkinter3.12.13-2.el10_2ALSA-2026:19064
AlmaLinux:8python3.123.12.13-2.el8_10ALSA-2026:10950
AlmaLinux:9python3.123.12.13-2.el9_8ALSA-2026:19177
AlmaLinux:8python3.12-debug3.12.13-2.el8_10ALSA-2026:10950
AlmaLinux:9python3.12-debug3.12.13-2.el9_8ALSA-2026:19177
AlmaLinux:8python3.12-devel3.12.13-2.el8_10ALSA-2026:10950
AlmaLinux:9python3.12-devel3.12.13-2.el9_8ALSA-2026:19177
AlmaLinux:8python3.12-idle3.12.13-2.el8_10ALSA-2026:10950
AlmaLinux:9python3.12-idle3.12.13-2.el9_8ALSA-2026:19177
AlmaLinux:8python3.12-libs3.12.13-2.el8_10ALSA-2026:10950
AlmaLinux:9python3.12-libs3.12.13-2.el9_8ALSA-2026:19177
AlmaLinux:8python3.12-rpm-macros3.12.13-2.el8_10ALSA-2026:10950
AlmaLinux:8python3.12-test3.12.13-2.el8_10ALSA-2026:10950
AlmaLinux:9python3.12-test3.12.13-2.el9_8ALSA-2026:19177
AlmaLinux:8python3.12-tkinter3.12.13-2.el8_10ALSA-2026:10950
AlmaLinux:9python3.12-tkinter3.12.13-2.el9_8ALSA-2026:19177
Debian:12pypy3no fix listedDEBIAN-CVE-2025-13837
Debian:13pypy3no fix listedDEBIAN-CVE-2025-13837
Debian:14pypy37.3.21+dfsg-1DEBIAN-CVE-2025-13837
Debian:12python3.113.11.2-6+deb12u7DEBIAN-CVE-2025-13837
Debian:13python3.133.13.5-2+deb13u1DEBIAN-CVE-2025-13837
Debian:14python3.143.14.2-1DEBIAN-CVE-2025-13837
Rocky Linux:10python3.120:3.12.13-2.el10_2RLSA-2026:19064
Rocky Linux:8python3.120:3.12.13-2.el8_10RLSA-2026:10950
Rocky Linux:9python3.120:3.12.13-2.el9_8RLSA-2026:19177
Ubuntu:22.04:LTSpython2.7no fix listedUBUNTU-CVE-2025-13837
Ubuntu:22.04:LTSpython3.103.10.12-1~22.04.14UBUNTU-CVE-2025-13837
Ubuntu:24.04:LTSpython3.123.12.3-1ubuntu0.11UBUNTU-CVE-2025-13837
Ubuntu:25.10python3.133.13.7-1ubuntu0.3UBUNTU-CVE-2025-13837
Ubuntu:25.10python3.143.14.0-1ubuntu0.2UBUNTU-CVE-2025-13837

Affected products (as reported)

VendorProductVersions
Python Software Foundation CPython 0 – before 3.10.203.11.0 – before 3.11.153.12.0 – before 3.12.133.13.0 – before 3.13.103.14.0 – before 3.14.13.15.0a1 – before 3.15.0a3

Weakness: CWE-400 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N

References