PT-2025-48535 · Http+5 · Http+5
Serhiy Storchaka
·
Publicado
2024-05-23
·
Atualizado
2026-05-11
·
CVE-2025-13836
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
python3.9
python3.11
python3.13
Description
When reading an HTTP response from a server, if no read amount is specified, the default behavior is to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing Out Of Memory (OOM) errors or other Denial of Service (DoS) conditions. The issue resides in the
http.client module.Recommendations
For python3.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For python3.11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For python3.13, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Resource Exhaustion
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Debian
Http
Linuxmint
Red Os
Rocky Linux
Ubuntu