CVE-2025-13836

Published Dec 1, 2025

Last updated 3 months ago

Overview

Description
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Source
cna@python.org
NVD status
Analyzed
Products
python

Risk scores

CVSS 4.0

Type
Secondary
Base score
6.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
MEDIUM

CVSS 3.1

Type
Primary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-400

Social media

Hype score
Not currently trending
  1. Critical Python 3.11 patch for #SUSE/#openSUSE. Fixes CVE-2025-12084 (DoS), CVE-2025-13836 (HTTP attack), CVE-2025-13837 (OOM). Patch now: zypper patch. Read more: 👉 https://t.co/fVQpiETgDS #Security https://t.co/6WmUY6Vfz2

    @Cezar_H_Linux

    29 Jan 2026

    61 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. URGENT: Patch #Python 3.11 on #Fedora43 now! CVEs: CVE-2025-13836 (HTTP Client DoS) & CVE-2025-12084 (XML DoS). Read more: 👉 https://t.co/qqmeV8ENhc #Security #Fedora https://t.co/SpyXSgQjzC

    @Cezar_H_Linux

    25 Jan 2026

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 Attention System Administrators & DevOps Professionals! 🚨 A critical Denial-of-Service (DoS) vulnerability (CVE-2025-13836) has been patched in #Python 3.12 on Fedora 43. Read more: 👉 https://t.co/5EqsSUM0Mw #Fedora #Security https://t.co/cQ64iRRnbd

    @Cezar_H_Linux

    25 Jan 2026

    42 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🔴 SECURITY UPDATE - 31/12/2025 Important CVE-2025-13836 identified: Excessive read buffering DoS in http.client. Affects multiple Windows versions. Immediate action required! 🛡️ Source: https://t.co/qZfISHME0a

    @kernyx64

    31 Dec 2025

    83 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. SECURITY ALERT: CVE-2025-13836 Exploit Fix & Mitigation Guide Read more: https://t.co/FAhIlRsSVR #Cybersecurity #CVE https://t.co/LTBoUCfkhk

    @SecReportCVE

    31 Dec 2025

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 3 CVEs in CPython https://t.co/F9quXztRRL CVE-2025-13836 Excessive read buffering DoS in http.client CVE-2025-13837 Out-of-memory when loading Plist CVE-2025-12084 Quadratic complexity in node ID cache clearing

    @oss_security

    6 Dec 2025

    344 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-13836 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cau… https://t.co/IuNWkfXi6x

    @CVEnew

    1 Dec 2025

    191 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations