Vulnerability · Published Dec 1, 2025 · Assigned by PSF
CVE-2025-13836Excessive read buffering DoS in http.client
Medium 6.3
In plain English
A medium-severity uncontrolled resource consumption in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)1.7%top 22.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | python-unversioned-command | 3.12.12-3.el10_1 | ALSA-2026:1828 |
| AlmaLinux:8 | python3.11 | 3.11.13-4.el8_10 | ALSA-2026:1374 |
| AlmaLinux:9 | python3.11 | 3.11.13-5.el9_7 | ALSA-2026:1410 |
| AlmaLinux:8 | python3.11-debug | 3.11.13-4.el8_10 | ALSA-2026:1374 |
| AlmaLinux:9 | python3.11-debug | 3.11.13-5.el9_7 | ALSA-2026:1410 |
| AlmaLinux:8 | python3.11-devel | 3.11.13-4.el8_10 | ALSA-2026:1374 |
| AlmaLinux:9 | python3.11-devel | 3.11.13-5.el9_7 | ALSA-2026:1410 |
| AlmaLinux:8 | python3.11-idle | 3.11.13-4.el8_10 | ALSA-2026:1374 |
| AlmaLinux:9 | python3.11-idle | 3.11.13-5.el9_7 | ALSA-2026:1410 |
| AlmaLinux:8 | python3.11-libs | 3.11.13-4.el8_10 | ALSA-2026:1374 |
| AlmaLinux:9 | python3.11-libs | 3.11.13-5.el9_7 | ALSA-2026:1410 |
| AlmaLinux:8 | python3.11-rpm-macros | 3.11.13-4.el8_10 | ALSA-2026:1374 |
| AlmaLinux:8 | python3.11-test | 3.11.13-4.el8_10 | ALSA-2026:1374 |
| AlmaLinux:9 | python3.11-test | 3.11.13-5.el9_7 | ALSA-2026:1410 |
| AlmaLinux:8 | python3.11-tkinter | 3.11.13-4.el8_10 | ALSA-2026:1374 |
| AlmaLinux:9 | python3.11-tkinter | 3.11.13-5.el9_7 | ALSA-2026:1410 |
| AlmaLinux:8 | python3.12 | 3.12.12-2.el8_10 | ALSA-2026:2419 |
| AlmaLinux:9 | python3.12 | 3.12.12-4.el9_7 | ALSA-2026:1408 |
| AlmaLinux:8 | python3.12-debug | 3.12.12-2.el8_10 | ALSA-2026:2419 |
| AlmaLinux:9 | python3.12-debug | 3.12.12-4.el9_7 | ALSA-2026:1408 |
| AlmaLinux:8 | python3.12-devel | 3.12.12-2.el8_10 | ALSA-2026:2419 |
| AlmaLinux:9 | python3.12-devel | 3.12.12-4.el9_7 | ALSA-2026:1408 |
| AlmaLinux:8 | python3.12-idle | 3.12.12-2.el8_10 | ALSA-2026:2419 |
| AlmaLinux:9 | python3.12-idle | 3.12.12-4.el9_7 | ALSA-2026:1408 |
| AlmaLinux:8 | python3.12-libs | 3.12.12-2.el8_10 | ALSA-2026:2419 |
| AlmaLinux:9 | python3.12-libs | 3.12.12-4.el9_7 | ALSA-2026:1408 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.12-2.el8_10 | ALSA-2026:2419 |
| AlmaLinux:8 | python3.12-test | 3.12.12-2.el8_10 | ALSA-2026:2419 |
| AlmaLinux:9 | python3.12-test | 3.12.12-4.el9_7 | ALSA-2026:1408 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.12-2.el8_10 | ALSA-2026:2419 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.12-4.el9_7 | ALSA-2026:1408 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2025-13836 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2025-13836 |
| Debian:14 | pypy3 | 7.3.21+dfsg-1 | DEBIAN-CVE-2025-13836 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u7 | DEBIAN-CVE-2025-13836 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u1 | DEBIAN-CVE-2025-13836 |
| Debian:14 | python3.14 | 3.14.2-1 | DEBIAN-CVE-2025-13836 |
| Rocky Linux:8 | python3.11 | 0:3.11.13-4.el8_10 | RLSA-2026:1374 |
| Rocky Linux:9 | python3.11 | 0:3.11.13-5.el9_7 | RLSA-2026:1410 |
| Rocky Linux:10 | python3.12 | 0:3.12.12-3.el10_1 | RLSA-2026:1828 |
| Rocky Linux:8 | python3.12 | 0:3.12.12-2.el8_10 | RLSA-2026:2419 |
| Rocky Linux:9 | python3.12 | 0:3.12.12-4.el9_7 | RLSA-2026:1408 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.13 | USN-7951-1 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.13 | UBUNTU-CVE-2025-13836 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.10 | UBUNTU-CVE-2025-13836 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.10 | USN-7951-1 |
| Ubuntu:25.10 | python3.13 | 3.13.7-1ubuntu0.2 | UBUNTU-CVE-2025-13836 |
| Ubuntu:25.10 | python3.13 | 3.13.7-1ubuntu0.2 | USN-7951-1 |
| Ubuntu:25.10 | python3.14 | 3.14.0-1ubuntu0.1 | UBUNTU-CVE-2025-13836 |
| Ubuntu:25.10 | python3.14 | 3.14.0-1ubuntu0.1 | USN-7951-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.203.11.0 – before 3.11.153.12.0 – before 3.12.133.13.0 – before 3.13.113.14.0 – before 3.14.13.15.0a1 – before 3.15.0a3 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
References
- https://github.com/python/cpython/issues/119451 issue-tracking
- https://github.com/python/cpython/pull/119454 patch
- https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155 patch
- https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/ vendor-advisory
- https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15 patch
- https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628 patch
- https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0 patch
- https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c patch