vulnerability

Red Hat: CVE-2025-13836: cpython: Excessive read buffering DoS in http.client (Multiple Advisories)

Severity
7
CVSS
(AV:N/AC:M/Au:N/C:N/I:N/A:C)
Published
Dec 1, 2025
Added
Jan 28, 2026
Modified
Feb 10, 2026

Description

A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.

Solutions

redhat-upgrade-python-unversioned-commandredhat-upgrade-python3redhat-upgrade-python3-11redhat-upgrade-python3-11-debugredhat-upgrade-python3-11-debuginforedhat-upgrade-python3-11-debugsourceredhat-upgrade-python3-11-develredhat-upgrade-python3-11-idleredhat-upgrade-python3-11-libsredhat-upgrade-python3-11-rpm-macrosredhat-upgrade-python3-11-testredhat-upgrade-python3-11-tkinterredhat-upgrade-python3-12redhat-upgrade-python3-12-debugredhat-upgrade-python3-12-debuginforedhat-upgrade-python3-12-debugsourceredhat-upgrade-python3-12-develredhat-upgrade-python3-12-idleredhat-upgrade-python3-12-libsredhat-upgrade-python3-12-testredhat-upgrade-python3-12-tkinterredhat-upgrade-python3-debugredhat-upgrade-python3-develredhat-upgrade-python3-idleredhat-upgrade-python3-libsredhat-upgrade-python3-testredhat-upgrade-python3-tkinter
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.