BaseFortify

Publication date: 2025-12-01

Last updated on: 2026-05-18

Assigner: Python Software Foundation

Description

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-01

Last Modified

2026-05-18

Generated

2026-07-06

AI Q&A

2025-12-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13836

Affected Vendors & Products

Vendor	Product	Version / Range
python	python	3.15.0
python	python	3.15.0
python	python	3.14.0
python	python	to 3.10.20 (exc)
python	python	From 3.11.0 (inc) to 3.11.15 (exc)
python	python	From 3.12.0 (inc) to 3.12.13 (exc)
python	python	From 3.13.0 (inc) to 3.13.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when reading an HTTP response from a server without specifying a read amount. The default behavior uses the Content-Length header, which a malicious server can exploit to cause the client to read excessively large amounts of data into memory. This can lead to out-of-memory (OOM) conditions or other denial-of-service (DoS) effects.

Impact Analysis

The vulnerability can cause your client application to consume excessive memory by reading large amounts of data, potentially leading to out-of-memory errors or denial-of-service conditions that disrupt normal operation.

Hi! I’m here to help you understand CVE-2025-13836. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70