CVE-2025-13836
BaseFortify
Publication date: 2025-12-01
Last updated on: 2026-05-18
Assigner: Python Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| python | python | 3.15.0 |
| python | python | 3.15.0 |
| python | python | 3.14.0 |
| python | python | to 3.10.20 (exc) |
| python | python | From 3.11.0 (inc) to 3.11.15 (exc) |
| python | python | From 3.12.0 (inc) to 3.12.13 (exc) |
| python | python | From 3.13.0 (inc) to 3.13.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when reading an HTTP response from a server without specifying a read amount. The default behavior uses the Content-Length header, which a malicious server can exploit to cause the client to read excessively large amounts of data into memory. This can lead to out-of-memory (OOM) conditions or other denial-of-service (DoS) effects.
How can this vulnerability impact me? :
The vulnerability can cause your client application to consume excessive memory by reading large amounts of data, potentially leading to out-of-memory errors or denial-of-service conditions that disrupt normal operation.