CVE-2025-13836
published 2025-12-01CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.52%
71.8th percentile
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.11 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.13 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.14 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.9 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| msrc | azl3_python3_3.12.9-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.9-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.9-7_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python3_3.9.19-16_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-17_on_cbl_mariner_2.0 | — | — |
| python | python | < 3.10.20 | 3.10.20 |
| python | python | — | — |
| python | python | — | — |
| python | python | >= 3.11.0 < 3.11.15 | 3.11.15 |
| python | python | >= 3.12.0 < 3.12.13 | 3.12.13 |
| python | python | >= 3.13.0 < 3.13.11 | 3.13.11 |
| python_software_foundation | cpython | < 3.10.20 | 3.10.20 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.15 | 3.11.15 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.13 | 3.12.13 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.11 | 3.13.11 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.1 | 3.14.1 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0a3 | 3.15.0a3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.3MEDIUM
vendor_debian6.3MEDIUM
vendor_msrc6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python vulnerability
vendor_ubuntu·2026-01-12
CVE-2025-13836 Python vulnerability
Title: Python vulnerability
Summary: Python could be made to crash if it received specially crafted network
traffic.
It was discovered that Python's http.client did not properly handle the
Content-Length header in HTTP responses. A malicious server could exploit
this to cause Python to allocate excessive memory, leading to a denial of
service.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Excessive read buffering DoS in http.client
vendor_msrc·2025-12-09·CVSS 6.3
CVE-2025-13836 [MEDIUM] CWE-400 Excessive read buffering DoS in http.client
Excessive read buffering DoS in http.client
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Red Hat
cpython: Excessive read buffering DoS in http.client
vendor_redhat·2025-12-01·CVSS 6.3
CVE-2025-13836 [MEDIUM] CWE-770 cpython: Excessive read buffering DoS in http.client
cpython: Excessive read buffering DoS in http.client
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.
Statement: This issue can only be exploited by Python applications using
Debian
CVE-2025-13836: pypy3 - When reading an HTTP response from a server, if no read amount is specified, the...
vendor_debian·2025·CVSS 6.3
CVE-2025-13836 [MEDIUM] CVE-2025-13836: pypy3 - When reading an HTTP response from a server, if no read amount is specified, the...
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Scope: local
bookworm: open
bullseye: resolved
forky: open
sid: open
trixie: open
OSV
CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length
osv·2025-12-01·CVSS 6.3
CVE-2025-13836 [MEDIUM] CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
GHSA
GHSA-399h-rrqc-rpgv: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length
ghsa_unreviewed·2025-12-01
CVE-2025-13836 [MEDIUM] CWE-125 GHSA-399h-rrqc-rpgv: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [fedora-42]
bugzilla·2026-01-13·CVSS 6.3
CVE-2025-13836 [MEDIUM] CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [fedora-42]
CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug
Bugzilla
CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [fedora-43]
bugzilla·2026-01-13·CVSS 7.5
CVE-2025-13836 [HIGH] CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [fedora-43]
CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This CVE is in the CPython interpreter, fixed by the python3 update; this package only uses the affected stdlib module and needs no change of its own.
Bugzilla
CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [epel-10]
bugzilla·2026-01-13·CVSS 7.5
CVE-2025-13836 [HIGH] CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [epel-10]
CVE-2025-13836 asahi-installer: Excessive read buffering DoS in http.client [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This CVE is in the CPython interpreter, fixed by the python3 update; this package only uses the affected stdlib module and needs no change of its own.
https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587chttps://github.com/python/cpython/issues/119451https://github.com/python/cpython/pull/119454https://mail.python.org/archives/list/[email protected]/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/
2025-12-01
Published