CVE-2025-13836

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Uncontrolled Resource Consumption pada python. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

Rincian

Terbit di NVD

1 Desember 2025

Terakhir diubah

3 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/ advisory vendor
• https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628 patch
• https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15 patch
• https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155 patch
• https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5 patch
• https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0 patch
• https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c patch
• https://github.com/python/cpython/issues/119451 issue tracking · patch
• https://github.com/python/cpython/pull/119454 issue tracking · patch