Out-of-bounds Read SNYK-DEBIAN11-PYTHON39-14157076 #7245

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.9 package and not the python3.9 package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

Remediation

Upgrade Debian:11 python3.9 to version 3.9.2-1+deb11u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-13836
• python/cpython@14b1fdb
• python/cpython@289f29b
• python/cpython@4ce2790
• python/cpython@5a4c4a0
• Out-of-memory when reading a HTTP response with large Content-Length python/cpython#119451
• gh-119451: Fix a potential denial of service in http.client python/cpython#119454
• https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/