CVE-2025-13836: Excessive read buffering DoS in http.client
Excessive read buffering DoS in http.client
Other sources
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13836?
CVE-2025-13836 has been rated as a moderate severity vulnerability due to potential denial of service effects.
How do I fix CVE-2025-13836?
To mitigate CVE-2025-13836, ensure you specify a read amount when using http.client to avoid excessive memory usage.
What software is affected by CVE-2025-13836?
CVE-2025-13836 affects the http.client module in various Python versions as well as certain Microsoft products using Python.
What kind of attack does CVE-2025-13836 enable?
CVE-2025-13836 enables a denial of service attack by allowing malicious servers to force clients to read excessive amounts of data.
Is CVE-2025-13836 exploitable over the network?
Yes, CVE-2025-13836 is exploitable over the network, as it stems from interactions with HTTP responses from remote servers.