CVE-2025-13836 — Excessive read buffering DoS in http.client

Affected: Python Software Foundation CPython

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

RHSA-2026:1374 — Red Hat Security Advisory: python3.11 security update

cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service cpython: Excessive read buffering DoS in http.client

RHSA-2026:1736 — Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

curl: libcurl: Curl out of bounds read for cookie path openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service postgresql: libpq: libpq undersizes allocations, via integer wraparound glib: Integer overflow in in g_escape_uri_string() cpython: Excessive read buffering DoS in http.client openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing openssl: OpenSSL: Denial of Service via malformed TimeStamp Response openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing urllib…

Most recent entries from all

CVE-2025-13836 — Excessive read buffering DoS in http.client

RHSA-2026:1374 — Red Hat Security Advisory: python3.11 security update

RHSA-2026:1736 — Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage