CVE-2025-13836
High · 7.5CVSS
7.5
EPSS
1.6%
Published
Dec 1, 2025
CISA due date
—
The record
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | python3.11 | 0 | 3.11.13-4.el8_10 |
| AlmaLinux:8 | python3.11-debug | 0 | 3.11.13-4.el8_10 |
| AlmaLinux:8 | python3.11-devel | 0 | 3.11.13-4.el8_10 |
| AlmaLinux:8 | python3.11-idle | 0 | 3.11.13-4.el8_10 |
| AlmaLinux:8 | python3.11-libs | 0 | 3.11.13-4.el8_10 |
| AlmaLinux:8 | python3.11-rpm-macros | 0 | 3.11.13-4.el8_10 |
| AlmaLinux:8 | python3.11-test | 0 | 3.11.13-4.el8_10 |
| AlmaLinux:8 | python3.11-tkinter | 0 | 3.11.13-4.el8_10 |
| Bitnami | libpython | 0 | 3.13.11 |
| Bitnami | libpython | 0 | 3.14.1 |
| Bitnami | python | 0 | 3.13.11 |
| Bitnami | python | 0 | 3.14.1 |
| Bitnami | python-min | 0 | 3.13.11 |
| Bitnami | python-min | 0 | 3.14.1 |
| Chainguard | python-3.10 | 0 | 3.10.19-r4 |
| Chainguard | python-3.10-base | 0 | 3.10.19-r3 |
| Chainguard | python-3.10-base-dev | 0 | 3.10.19-r3 |
| Chainguard | python-3.10-dev | 0 | 3.10.19-r3 |
| Chainguard | python-3.10-doc | 0 | 3.10.19-r3 |
| Chainguard | python-3.11 | 0 | 3.11.14-r5 |
| Chainguard | python-3.11-base | 0 | 3.11.14-r3 |
| Chainguard | python-3.11-base-dev | 0 | 3.11.14-r3 |
| Chainguard | python-3.11-dev | 0 | 3.11.14-r3 |
| Chainguard | python-3.11-doc | 0 | 3.11.14-r3 |
| Chainguard | python-3.12 | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-base | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-base-dev | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-dev | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-doc | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-privileged-netbindservice | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-tk | 0 | 3.12.12-r4 |
| Chainguard | python-3.13 | 0 | 3.13.11-r2 |
| Chainguard | python-3.13-base | 0 | 3.13.11-r1 |
| Chainguard | python-3.13-base-dev | 0 | 3.13.11-r1 |
| Chainguard | python-3.13-dev | 0 | 3.13.11-r1 |
| Chainguard | python-3.13-doc | 0 | 3.13.11-r1 |
| Chainguard | python-3.13-privileged-netbindservice | 0 | 3.13.11-r1 |
| Chainguard | python-3.13-tk | 0 | 3.13.11-r1 |
| Chainguard | python-3.9-base | 0 | 3.9.25-r0 |
| Chainguard | python-3.9-base-dev | 0 | 3.9.25-r0 |
| Chainguard | python-3.9-dev | 0 | 3.9.25-r0 |
| Chainguard | python-3.9-doc | 0 | 3.9.25-r0 |
| Mageia:9 | python3 | 0 | 3.10.18-1.5.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | salt | 0 | 3006.0-150500.4.68.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | salt | 0 | 3006.0-150500.4.68.2 |
| SUSE:Linux Enterprise Micro 5.2 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.2 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.3 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.3 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.4 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.4 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.5 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.5 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.5 | salt | 0 | 3006.0-150500.4.68.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python311-core | 0 | 3.11.14-150600.3.41.2 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python | 0 | 2.7.18-150000.94.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python-base | 0 | 2.7.18-150000.94.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311 | 0 | 3.11.14-150600.3.41.2 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311-core | 0 | 3.11.14-150600.3.41.2 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | salt | 0 | 3006.0-150500.4.68.2 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | salt | 0 | 3006.0-150500.4.68.2 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python3 | 0 | 3.4.10-25.166.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python3-base | 0 | 3.4.10-25.166.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python36 | 0 | 3.6.15-97.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python36-core | 0 | 3.6.15-97.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | salt | 0 | 3006.0-150500.4.68.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | salt | 0 | 3006.0-150500.4.68.2 |
| Wolfi | python-3.10 | 0 | 3.10.19-r4 |
| Wolfi | python-3.10-base | 0 | 3.10.19-r3 |
| Wolfi | python-3.10-base-dev | 0 | 3.10.19-r3 |
| Wolfi | python-3.10-dev | 0 | 3.10.19-r3 |
| Wolfi | python-3.10-doc | 0 | 3.10.19-r3 |
| Wolfi | python-3.11 | 0 | 3.11.14-r5 |
| Wolfi | python-3.11-base | 0 | 3.11.14-r3 |
| Wolfi | python-3.11-base-dev | 0 | 3.11.14-r3 |
| Wolfi | python-3.11-dev | 0 | 3.11.14-r3 |
| Wolfi | python-3.11-doc | 0 | 3.11.14-r3 |
| Wolfi | python-3.12 | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-base | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-base-dev | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-dev | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-doc | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-privileged-netbindservice | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-tk | 0 | 3.12.12-r4 |
| Wolfi | python-3.13 | 0 | 3.13.11-r2 |
| Wolfi | python-3.13-base | 0 | 3.13.11-r1 |
| Wolfi | python-3.13-base-dev | 0 | 3.13.11-r1 |
| Wolfi | python-3.13-dev | 0 | 3.13.11-r1 |
| Wolfi | python-3.13-doc | 0 | 3.13.11-r1 |
| Wolfi | python-3.13-privileged-netbindservice | 0 | 3.13.11-r1 |
| Wolfi | python-3.13-tk | 0 | 3.13.11-r1 |
| openSUSE:Leap 15.6 | python | 0 | 2.7.18-150000.94.1 |
| openSUSE:Leap 15.6 | python-base | 0 | 2.7.18-150000.94.1 |
| openSUSE:Leap 15.6 | python-doc | 0 | 2.7.18-150000.94.1 |
| openSUSE:Leap 15.6 | python3 | 0 | 3.6.15-150300.10.103.1 |
| openSUSE:Leap 15.6 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| openSUSE:Leap 15.6 | python3-documentation | 0 | 3.6.15-150300.10.103.1 |
| openSUSE:Leap 15.6 | python310 | 0 | 3.10.19-150400.4.94.1 |
| openSUSE:Leap 15.6 | python310-core | 0 | 3.10.19-150400.4.94.1 |
| openSUSE:Leap 15.6 | python310-documentation | 0 | 3.10.19-150400.4.94.1 |
| openSUSE:Leap 15.6 | python311 | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python311 | 0 | 3.11.14-150600.3.41.2 |
| openSUSE:Leap 15.6 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python311-core | 0 | 3.11.14-150600.3.41.2 |
| openSUSE:Leap 15.6 | python311-documentation | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python311-documentation | 0 | 3.11.14-150600.3.41.1 |
| openSUSE:Leap 15.6 | python312 | 0 | 3.12.12-150600.3.40.1 |
| openSUSE:Leap 15.6 | python312-core | 0 | 3.12.12-150600.3.40.1 |
| openSUSE:Leap 15.6 | python312-documentation | 0 | 3.12.12-150600.3.40.1 |
| openSUSE:Leap 15.6 | python39 | 0 | 3.9.25-150300.4.90.1 |
| openSUSE:Leap 15.6 | python39-core | 0 | 3.9.25-150300.4.90.1 |
| openSUSE:Leap 15.6 | python39-documentation | 0 | 3.9.25-150300.4.90.1 |
| openSUSE:Leap 15.6 | salt | 0 | 3006.0-150500.4.68.2 |
| openSUSE:Leap 15.6 | salt-test | 0 | 3006.0-150500.4.68.1 |
| openSUSE:Leap 16.0 | python313 | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | python313-core | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | python313-documentation | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | python313-nogil | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | python313-nogil-nogil-core | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | salt | 0 | 3006.0-160000.4.1 |
| openSUSE:Leap 16.0 | salt-test | 0 | 3006.0-160000.4.1 |
| openSUSE:Tumbleweed | python310 | 0 | 3.10.19-3.1 |
| openSUSE:Tumbleweed | python311 | 0 | 3.11.14-3.1 |
| openSUSE:Tumbleweed | python312 | 0 | 3.12.12-4.1 |
| openSUSE:Tumbleweed | python313 | 0 | 3.13.11-1.1 |
| openSUSE:Tumbleweed | python314 | 0 | 3.14.2-1.1 |
| openSUSE:Tumbleweed | python315 | 0 | 3.15.0~a3-1.1 |
| openSUSE:Tumbleweed | python39 | 0 | 3.9.25-2.1 |
| openSUSE:Tumbleweed | salt | 0 | 3006.0-56.1 |
Related vulnerabilities
- PSF-2025-14 When reading an HTTP response from a server, if no read amount is specified, the default… Same vulnerability
- CVE-2025-12084 When building nested elements using xml.dom.minidom methods such as appendChild() that… Also affects python3.11
- CVE-2024-9287 A vulnerability has been found in the CPython `venv` module and CLI where path names… Also affects python3.11
- CVE-2024-6232 There is a MEDIUM severity vulnerability affecting CPython. Also affects python3.11
- CVE-2024-8088 There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting… Also affects python3.11
- CVE-2024-6923 There is a MEDIUM severity vulnerability affecting CPython. Also affects python3.11
- CVE-2024-4032 The “ipaddress” module contained incorrect information about whether certain IPv4 and… Also affects python3.11
- CVE-2024-0450 An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7… Also affects python3.11