CVE-2025-13836 — Uncontrolled Resource Consumption in Software Foundation Cpython

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-125 — Out-of-bounds Read8 documents8 sources
Severity
6.3MEDIUMNVD
EPSS
0.2%
top 58.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Python Software Foundation CpythonPython
Timeline
PublishedDec 1
Latest updateJan 12

Description

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Affected Packages2 packages

▶NVDpython/python< 3.13.11+2
▶CVEListV5python_software_foundation/cpython3.11.0 — 3.11.15+5

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
CVEList
Excessive read buffering DoS in http.client↗2025-12-01
▶
OSV
CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length↗2025-12-01
▶
GHSA
GHSA-399h-rrqc-rpgv: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length↗2025-12-01
▶

📋Vendor Advisories

4
Ubuntu
Python vulnerability↗2026-01-12
▶
Microsoft
Excessive read buffering DoS in http.client↗2025-12-09
▶
Red Hat
cpython: Excessive read buffering DoS in http.client↗2025-12-01
▶
Debian
CVE-2025-13836: pypy3 - When reading an HTTP response from a server, if no read amount is specified, the...↗2025
▶
CVE-2025-13836 — Uncontrolled Resource Consumption | cvebase