CPython vulnerable to CVE-2025-13836, CVE-2025-13837, & CVE-2025-12084

[Alan Coopersmith <alan.coopersmith () oracle com>]

-------- Forwarded Message --------
Subject: [Security-announce][CVE-2025-13836] Excessive read buffering DoS in http.client
Date:   Mon, 1 Dec 2025 18:57:32 +0000
From:   Seth Larson <seth () python org>
Reply-To:       security-sig () python org
To:     security-announce () python org



There is a MEDIUM severity vulnerability affecting CPython.

When reading an HTTP response from a server, if no read amount is specified, the
default behavior will be to use Content-Length. This allows a malicious server
to cause the client to read large amounts of data into memory, potentially
causing OOM or other DoS.

Please see the linked CVE ID for the latest information on
affected versions:

* https://www.cve.org/CVERecord?id=CVE-2025-13836
* https://github.com/python/cpython/pull/119454


-------- Forwarded Message --------
Subject: [Security-announce][CVE-2025-13837] Out-of-memory when loading Plist
Date:   Mon, 1 Dec 2025 18:58:33 +0000
From:   Seth Larson <seth () python org>
Reply-To:       security-sig () python org
To:     security-announce () python org



There is a LOW severity vulnerability affecting CPython.

When loading a plist file, the plistlib module reads data in size specified by
the file itself, meaning a malicious file can cause OOM and DoS issues

Please see the linked CVE ID for the latest information on affected versions:

* https://www.cve.org/CVERecord?id=CVE-2025-13837
* https://github.com/python/cpython/pull/119343


-------- Forwarded Message --------
Subject: [Security-announce][CVE-2025-12084] Quadratic complexity in node ID cache clearing
Date:   Wed, 3 Dec 2025 18:59:03 +0000
From:   Seth Larson <seth () python org>
Reply-To:       security-sig () python org
To:     security-announce () python org



There is a MEDIUM severity vulnerability affecting CPython.

When building nested elements using xml.dom.minidom methods such as
appendChild() that have a dependency on _clear_id_cache() the algorithm is
quadratic. Availability can be impacted when building excessively nested
documents.

Please see the linked CVE ID for the latest information on affected versions:

* https://www.cve.org/CVERecord?id=CVE-2025-12084
* https://github.com/python/cpython/pull/142146