CVE-2025-13836 MEDIUM

CVE-2025-13836: Excessive read buffering DoS in http.client

Vendor Python Software Foundation
Product CPython
Published December 1, 2025
Last update March 3, 2026

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

What the vulnerability does

01Description

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

Key dates

02Disclosure timeline

December 1, 2025 CVE published
March 3, 2026 Record updated