PSF-2025-14
NoneCVSS
—
EPSS
—
Published
Dec 1, 2025
CISA due date
—
The record
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | libpython | 0 | 3.13.11 |
| Bitnami | libpython | 0 | 3.14.1 |
| Bitnami | python | 0 | 3.13.11 |
| Bitnami | python | 0 | 3.14.1 |
| Bitnami | python-min | 0 | 3.13.11 |
| Bitnami | python-min | 0 | 3.14.1 |
Related vulnerabilities
- CVE-2025-13836 When reading an HTTP response from a server, if no read amount is specified, the default… Same vulnerability
- CVE-2026-1299 The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines… Also affects libpython
- PSF-2026-8 The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines… Also affects libpython
- CVE-2025-12781 When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode()… Also affects libpython
- PSF-2026-7 When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode()… Also affects libpython
- CVE-2026-0672 When using http.cookies.Morsel, user-controlled cookie values and parameters can allow… Also affects libpython
- CVE-2026-0865 User-controlled header names and values containing newlines can allow injecting HTTP… Also affects libpython
- CVE-2025-15367 The poplib module, when passed a user-controlled command, can have additional commands… Also affects libpython