SB2025120602 - Denial of service in Python
Published: December 6, 2025
Security Bulletin ID
SB2025120602
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Resource exhaustion (CVE-ID: CVE-2025-13836)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when reading HTTP responses in Lib/http/client.py. A remote attacker can trigger memory exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15
- https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155
- https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5
- https://github.com/python/cpython/issues/119451
- https://github.com/python/cpython/pull/119454
- https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/