CVE-2025-13836 Details

A denial-of-service vulnerability has been identified in the Python http.client module. When reading an HTTP response, the client by default relies on the Content-Length header to determine how much data to read. If a malicious server sends a response with a large Content-Length value, the client can be tricked into consuming excessive amounts of memory. This issue can lead to out-of-memory errors, process or container termination, or even system crashes. The vulnerability is present in Python versions 3.10, 3.11, 3.12, 3.13, and 3.14.

The vulnerability has been fixed in Python versions 3.10, 3.11, 3.12, 3.13, and 3.14. Users can upgrade to these versions to address the vulnerability.