CVE-2025-13837CWE-400denial-of-service

CVE-2025-13837

Medium · published December 1, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00223 · 12.2th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-12-01T23:16Z
Affected products (4)
ProductVersionsFixed in
python/python< 3.13.103.13.10
python/python≥ 3.14.0, < 3.14.13.14.1
python/pythonall versions—
python/pythonall versions—
References (9)
https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036 · [email protected]https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b · [email protected]https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70 · [email protected]https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba · [email protected]https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb · [email protected]https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111 · [email protected]https://github.com/python/cpython/issues/119342 · [email protected]https://github.com/python/cpython/pull/119343 · [email protected]https://mail.python.org/archives/list/[email protected]/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/ · [email protected]
EPSS history
Timeline
  • 01 DEC 18:13Z
    Out-of-memory when loading Plist
    cvelistv5