CVE-2024-12254
published 2024-12-06CVE-2024-12254: Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.88%
77.1th percentile
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
method would not "pause" writing and signal to the Protocol to drain
the buffer to the wire once the write buffer reached the "high-water
mark". Because of this, Protocols would not periodically drain the write
buffer potentially leading to memory exhaustion.
This
vulnerability likely impacts a small number of users, you must be using
Python 3.12.0 or later, on macOS or Linux, using the asyncio module
with protocols, and using .writelines() method which had new
zero-copy-on-write behavior in Python 3.12.0 and later. If not all of
these factors are true then your usage of Python is unaffected.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python3.11 | < python3.13 3.13.1-2 (forky) | python3.13 3.13.1-2 (forky) |
| debian | python3.13 | < python3.13 3.13.1-2 (forky) | python3.13 3.13.1-2 (forky) |
| debian | python3.9 | < python3.13 3.13.1-2 (forky) | python3.13 3.13.1-2 (forky) |
| msrc | azl3_python3_3.12.3-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.9 | 3.12.9 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.2 | 3.13.2 |
| python_software_foundation | cpython | >= 3.14.0a1 < 3.14.0a3 | 3.14.0a3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.7HIGH
vendor_debian8.7LOW
vendor_redhat8.7HIGH
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python vulnerability
vendor_ubuntu·2025-01-20
CVE-2024-12254 Python vulnerability
Title: Python vulnerability
Summary: Python could be made to consume resources if it received specially crafted
network traffic.
It was discovered that Python incorrectly handled asyncio write buffers. A
remote attacker could possibly use this issue to cause Python to consume
memory, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Unbounded memory buffering in SelectorSocketTransport.writelines()
vendor_msrc·2024-12-10·CVSS 7.5
CVE-2024-12254 [HIGH] CWE-400 Unbounded memory buffering in SelectorSocketTransport.writelines()
Unbounded memory buffering in SelectorSocketTransport.writelines()
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:
Red Hat
python: Unbounded memory buffering in SelectorSocketTransport.writelines()
vendor_redhat·2024-12-06·CVSS 8.7
CVE-2024-12254 [HIGH] CWE-770 python: Unbounded memory buffering in SelectorSocketTransport.writelines()
python: Unbounded memory buffering in SelectorSocketTransport.writelines()
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
method would not "pause" writing and signal to the Protocol to drain
the buffer to the wire once the write buffer reached the "high-water
mark". Because of this, Protocols would not periodically drain the write
buffer potentially leading to memory exhaustion.
This
vulnerability likely impacts a small number of users, you must be using
Python 3.12.0 or later, on macOS or Linux, using the asyncio module
with protocols, and using .writelines() method which had new
zero-copy-on-write behavior in Python 3.12.0 and later. If not all of
these factors are true then your usage of Python is unaffected.
A flaw was found in Python. In certain configu
Debian
CVE-2024-12254: python3.11 - Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() me...
vendor_debian·2024·CVSS 8.7
CVE-2024-12254 [HIGH] CVE-2024-12254: python3.11 - Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() me...
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
Scope: local
bookworm: resolved
OSV
CVE-2024-12254: Starting in Python 3
osv·2024-12-06·CVSS 8.7
CVE-2024-12254 [HIGH] CVE-2024-12254: Starting in Python 3
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
method would not "pause" writing and signal to the Protocol to drain
the buffer to the wire once the write buffer reached the "high-water
mark". Because of this, Protocols would not periodically drain the write
buffer potentially leading to memory exhaustion.
This
vulnerability likely impacts a small number of users, you must be using
Python 3.12.0 or later, on macOS or Linux, using the asyncio module
with protocols, and using .writelines() method which had new
zero-copy-on-write behavior in Python 3.12.0 and later. If not all of
these factors are true then your usage of Python is unaffected.
GHSA
GHSA-ph84-rcj2-fxxm: Starting in Python 3
ghsa_unreviewed·2024-12-06
CVE-2024-12254 [HIGH] CWE-400 GHSA-ph84-rcj2-fxxm: Starting in Python 3
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
method would not "pause" writing and signal to the Protocol to drain
the buffer to the wire once the write buffer reached the "high-water
mark". Because of this, Protocols would not periodically drain the write
buffer potentially leading to memory exhaustion.
This
vulnerability likely impacts a small number of users, you must be using
Python 3.12.0 or later, on macOS or Linux, using the asyncio module
with protocols, and using .writelines() method which had new
zero-copy-on-write behavior in Python 3.12.0 and later. If not all of
these factors are true then your usage of Python is unaffected.
OSV
CVE-2024-12254: Starting in Python 3
osv·2024-12-06·CVSS 8.7
CVE-2024-12254 [HIGH] CVE-2024-12254: Starting in Python 3
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
No detection rules found.
No public exploits indexed.
https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5https://github.com/python/cpython/commit/e991ac8f2037d78140e417cc9a9486223eb3e786https://github.com/python/cpython/issues/127655https://github.com/python/cpython/pull/127656https://mail.python.org/archives/list/[email protected]/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/http://www.openwall.com/lists/oss-security/2024/12/06/1https://security.netapp.com/advisory/ntap-20250404-0010/
2024-12-06
Published