PT-2024-10121 · Python+8 · Python+8
Seth Larson
·
Published
2024-12-06
·
Updated
2026-05-18
·
CVE-2024-12254
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Python versions 3.12.0 through 3.12.x
Python versions prior to 3.14.0a2
Description
The issue is related to the
asyncio. SelectorSocketTransport.writelines() method, which does not properly "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reaches the "high-water mark". This can lead to memory exhaustion, as Protocols do not periodically drain the write buffer. The issue likely impacts a small number of users who are using Python 3.12.0 or later on macOS or Linux, with the asyncio module and protocols, and using the .writelines() method.Recommendations
Python versions 3.12.0 through 3.12.x: Update to version 3.14.0a2 to resolve the issue.
Python versions prior to 3.14.0a2: Update to version 3.14.0a2 to stay protected.
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Linuxmint
Python
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu