CVE-2025-13836
📋 TL;DR
This vulnerability in Python's HTTP client libraries allows a malicious server to cause denial-of-service by forcing clients to read excessively large HTTP responses into memory. Attackers can exploit the default Content-Length handling to trigger out-of-memory conditions. This affects any Python application making HTTP requests to untrusted servers.
💻 Affected Systems
- Python
- Applications using Python's http.client, urllib, or requests libraries
📦 What is this software?
Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through memory exhaustion, potentially causing application crashes and system instability.
Likely Case
Degraded performance or temporary unavailability of affected services due to memory pressure.
If Mitigated
Minimal impact with proper memory limits and request validation in place.
🎯 Exploit Status
Exploitation requires only a malicious HTTP server; no authentication needed on client side.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions containing the referenced GitHub commits
Vendor Advisory: https://github.com/python/cpython/security/advisories
Restart Required: Yes
Instructions:
1. Update Python to version containing the fix commits. 2. Restart all affected applications. 3. Verify no applications are pinned to vulnerable versions.
🔧 Temporary Workarounds
Implement HTTP response size limits
allAdd explicit size limits when reading HTTP responses in application code
# In Python code, set max response size
response = requests.get(url, stream=True)
content = b''
for chunk in response.iter_content(chunk_size=8192):
content += chunk
if len(content) > MAX_SIZE: # e.g., 10MB
raise ValueError('Response too large')
Use streaming responses
allProcess HTTP responses in chunks rather than reading entire response into memory
# Use streaming mode
import requests
response = requests.get(url, stream=True)
for chunk in response.iter_content(chunk_size=8192):
process_chunk(chunk)
🧯 If You Can't Patch
- Implement network-level controls to restrict HTTP traffic to trusted servers only
- Deploy memory monitoring and alerting to detect abnormal memory consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check Python version and verify if it includes the fix commits (14b1fdb0a94b96f86fc7b86671ea9582b8676628 and related)Check Version:
python --versionVerify Fix Applied:
Test HTTP requests with large Content-Length headers to ensure memory usage remains bounded📡 Detection & Monitoring
Log Indicators:
- Abnormally large HTTP response sizes in application logs
- Memory exhaustion errors or warnings
Network Indicators:
- HTTP requests to unknown or suspicious servers
- Unusually large HTTP response payloads
SIEM Query:
source="application_logs" AND ("out of memory" OR "memory error" OR "response too large")🔗 References
- https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628
- https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15
- https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155
- https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5
- https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0
- https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c
- https://github.com/python/cpython/issues/119451
- https://github.com/python/cpython/pull/119454
- https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/
