CVE-2025-13837
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Dec 1, 2025
CISA due date
—
The record
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | libpython | 0 | 3.13.10 |
| Bitnami | python | 0 | 3.13.10 |
| Bitnami | python-min | 0 | 3.13.10 |
| Chainguard | python-3.10-base | 0 | 3.10.19-r3 |
| Chainguard | python-3.10-base-dev | 0 | 3.10.19-r3 |
| Chainguard | python-3.10-dev | 0 | 3.10.19-r3 |
| Chainguard | python-3.10-doc | 0 | 3.10.19-r3 |
| Chainguard | python-3.11-base | 0 | 3.11.14-r3 |
| Chainguard | python-3.11-base-dev | 0 | 3.11.14-r3 |
| Chainguard | python-3.11-dev | 0 | 3.11.14-r3 |
| Chainguard | python-3.11-doc | 0 | 3.11.14-r3 |
| Chainguard | python-3.12 | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-base | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-base-dev | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-dev | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-doc | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-privileged-netbindservice | 0 | 3.12.12-r4 |
| Chainguard | python-3.12-tk | 0 | 3.12.12-r4 |
| Chainguard | python-3.9-base | 0 | 3.9.25-r0 |
| Chainguard | python-3.9-base-dev | 0 | 3.9.25-r0 |
| Chainguard | python-3.9-dev | 0 | 3.9.25-r0 |
| Chainguard | python-3.9-doc | 0 | 3.9.25-r0 |
| Mageia:9 | python3 | 0 | 3.10.18-1.5.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Micro 5.2 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.2 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.3 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.3 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.4 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.4 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.5 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Micro 5.5 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python3 | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python311-core | 0 | 3.11.14-150600.3.41.2 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311 | 0 | 3.11.14-150600.3.41.2 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311-core | 0 | 3.11.14-150600.3.41.2 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python3 | 0 | 3.4.10-25.166.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python3-base | 0 | 3.4.10-25.166.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python36 | 0 | 3.6.15-97.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python36-core | 0 | 3.6.15-97.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | python311 | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | python311-core | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | python311-documentation | 0 | 3.11.14-150400.9.72.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| Wolfi | python-3.10-base | 0 | 3.10.19-r3 |
| Wolfi | python-3.10-base-dev | 0 | 3.10.19-r3 |
| Wolfi | python-3.10-dev | 0 | 3.10.19-r3 |
| Wolfi | python-3.10-doc | 0 | 3.10.19-r3 |
| Wolfi | python-3.11-base | 0 | 3.11.14-r3 |
| Wolfi | python-3.11-base-dev | 0 | 3.11.14-r3 |
| Wolfi | python-3.11-dev | 0 | 3.11.14-r3 |
| Wolfi | python-3.11-doc | 0 | 3.11.14-r3 |
| Wolfi | python-3.12 | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-base | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-base-dev | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-dev | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-doc | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-privileged-netbindservice | 0 | 3.12.12-r4 |
| Wolfi | python-3.12-tk | 0 | 3.12.12-r4 |
| openSUSE:Leap 15.6 | python3 | 0 | 3.6.15-150300.10.103.1 |
| openSUSE:Leap 15.6 | python3-core | 0 | 3.6.15-150300.10.103.1 |
| openSUSE:Leap 15.6 | python3-documentation | 0 | 3.6.15-150300.10.103.1 |
| openSUSE:Leap 15.6 | python310 | 0 | 3.10.19-150400.4.94.1 |
| openSUSE:Leap 15.6 | python310-core | 0 | 3.10.19-150400.4.94.1 |
| openSUSE:Leap 15.6 | python310-documentation | 0 | 3.10.19-150400.4.94.1 |
| openSUSE:Leap 15.6 | python311 | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python311 | 0 | 3.11.14-150600.3.41.2 |
| openSUSE:Leap 15.6 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python311-core | 0 | 3.11.14-150600.3.41.2 |
| openSUSE:Leap 15.6 | python311-documentation | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python311-documentation | 0 | 3.11.14-150600.3.41.1 |
| openSUSE:Leap 15.6 | python312 | 0 | 3.12.12-150600.3.40.1 |
| openSUSE:Leap 15.6 | python312-core | 0 | 3.12.12-150600.3.40.1 |
| openSUSE:Leap 15.6 | python312-documentation | 0 | 3.12.12-150600.3.40.1 |
| openSUSE:Leap 15.6 | python39 | 0 | 3.9.25-150300.4.90.1 |
| openSUSE:Leap 15.6 | python39-core | 0 | 3.9.25-150300.4.90.1 |
| openSUSE:Leap 15.6 | python39-documentation | 0 | 3.9.25-150300.4.90.1 |
| openSUSE:Leap 16.0 | python313 | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | python313-core | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | python313-documentation | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | python313-nogil | 0 | 3.13.11-160000.1.1 |
| openSUSE:Leap 16.0 | python313-nogil-nogil-core | 0 | 3.13.11-160000.1.1 |
| openSUSE:Tumbleweed | python310 | 0 | 3.10.19-3.1 |
| openSUSE:Tumbleweed | python311 | 0 | 3.11.14-3.1 |
| openSUSE:Tumbleweed | python312 | 0 | 3.12.12-4.1 |
| openSUSE:Tumbleweed | python313 | 0 | 3.13.11-1.1 |
| openSUSE:Tumbleweed | python314 | 0 | 3.14.2-1.1 |
| openSUSE:Tumbleweed | python315 | 0 | 3.15.0~a3-1.1 |
| openSUSE:Tumbleweed | python39 | 0 | 3.9.25-2.1 |
Related vulnerabilities
- PSF-2025-15 When loading a plist file, the plistlib module reads data in size specified by the file… Same vulnerability
- CVE-2026-1299 The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines… Also affects libpython
- PSF-2026-8 The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines… Also affects libpython
- CVE-2025-12781 When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode()… Also affects libpython
- PSF-2026-7 When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode()… Also affects libpython
- CVE-2026-0672 When using http.cookies.Morsel, user-controlled cookie values and parameters can allow… Also affects libpython
- CVE-2026-0865 User-controlled header names and values containing newlines can allow injecting HTTP… Also affects libpython
- CVE-2025-15367 The poplib module, when passed a user-controlled command, can have additional commands… Also affects libpython