Repository navigation
Out-of-memory when reading a HTTP response with large Content-Length #119451
Description
http.client.HTTPResponse.read() (without argument) consumes the amount of memory specified by the value of the Content-Lenght header in the response before starting receiving the data from the socket. Normally, if the server does not send enough data, the client gets IncompleteRead error, but if Content-Lenght is too large, it can consume a large amount of memory and CPU time and cause swapping. Therefore, a maleficent server can cause a DOS attack on client by sending a small response.
Linked PRs
- gh-119451: Fix a potential denial of service in http.client #119454
- [3.14] gh-119451: Fix a potential denial of service in http.client (GH-119454) #142138
- [3.13] gh-119451: Fix a potential denial of service in http.client (GH-119454) #142139
- [3.12] gh-119451: Fix a potential denial of service in http.client (GH-119454) #142140
- [3.11] gh-119451: Fix a potential denial of service in http.client (GH-119454) #142141
- [3.10] gh-119451: Fix a potential denial of service in http.client (GH-119454) #142142
Activity
pythongh-119451: Fix OOM vulnerability in http.client
25 remaining items
00472: CVE-2025-13836
CVE-2025-13836 python/cpython#119451
CVE-2025-13836 python/cpython#119451
lang/python314: security update to 3.14.2
lang/python314: security update to 3.14.2
[H p] Fix: OutOfMemory error in mirror Lambda function (#7730)
[H R] Fix: OutOfMemory error in mirror Lambda function (#7730)
[H R] Fix: OutOfMemory error in mirror Lambda function (#7730)
[H R] Fix: OutOfMemory error in mirror Lambda function (#7730)
[H R] Fix: OutOfMemory error in mirror Lambda function (#7730)
[CVE-2025-13836] Fix a potential denial of service in http.client
[CVE-2025-13836] Fix a potential denial of service in http.client
[CVE-2025-13836] Fix a potential denial of service in http.client
[CVE-2025-13836] Fix a potential denial of service in http.client