CVE-2025-13837
📋 TL;DR
CVE-2025-13837 is a denial-of-service vulnerability in Python's plistlib module where malicious plist files can trigger excessive memory allocation, causing out-of-memory conditions and service crashes. This affects any Python application that processes untrusted plist files, particularly web applications, file parsers, and data processing services.
💻 Affected Systems
- Python
- Applications using Python's plistlib module
📦 What is this software?
Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through resource exhaustion, potentially affecting multiple services on the same host due to memory starvation.
Likely Case
Application crashes or becomes unresponsive when processing malicious plist files, requiring manual intervention to restart.
If Mitigated
Limited impact with proper input validation and resource limits in place, potentially causing only individual request failures.
🎯 Exploit Status
Exploitation requires only creating a malicious plist file with crafted size fields. The GitHub issue includes proof-of-concept examples.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Python 3.13.2, 3.12.7, 3.11.12, 3.10.14
Vendor Advisory: https://github.com/python/cpython/issues/119342
Restart Required: Yes
Instructions:
1. Identify Python version with 'python --version'. 2. Upgrade to patched version using system package manager or Python installer. 3. Restart all Python applications and services. 4. Test plist processing functionality.
🔧 Temporary Workarounds
Input validation and size limits
allImplement file size validation and memory limits before processing plist files
# Python example: Validate file size before processing
import os
MAX_PLIST_SIZE = 10485760 # 10MB
if os.path.getsize('file.plist') > MAX_PLIST_SIZE:
raise ValueError('File too large')
Resource limits for Python processes
linuxSet memory limits on Python processes using system controls
# Linux using ulimit
ulimit -v 1000000 # Limit to 1GB virtual memory
# Or using systemd service file:
# MemoryMax=1G
🧯 If You Can't Patch
- Implement strict input validation rejecting plist files from untrusted sources
- Deploy memory monitoring and automatic restart mechanisms for Python services
🔍 How to Verify
Check if Vulnerable:
Check Python version and test with a crafted plist file containing large size fieldsCheck Version:
python --versionVerify Fix Applied:
Test plist processing with the same malicious file after patching - should reject or handle safely📡 Detection & Monitoring
Log Indicators:
- Python process crashes with memory errors
- High memory usage spikes during file processing
- Repeated plist parsing failures
Network Indicators:
- Multiple large file uploads to plist processing endpoints
- Unusual plist file sizes in network traffic
SIEM Query:
source="application.log" AND ("MemoryError" OR "plistlib" OR "out of memory") AND process="python"🔗 References
- https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036
- https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b
- https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70
- https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba
- https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb
- https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111
- https://github.com/python/cpython/issues/119342
- https://github.com/python/cpython/pull/119343
- https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/
