CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-13836 – Excessive read buffering DoS in http.client
https://notcve.org/view.php?id=CVE-2025-13836
01 Dec 2025 — When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS. This update for python312 fixes the following issues. Quadratic complexity when building nested elements using 'xml.dom.minidom' methods that depend on '_clear_id_cache' can lead to availability issues when building excessively nested documents. Use o... • https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2025-6075 – Quadratic complexity in os.path.expandvars() with user-controlled template
https://notcve.org/view.php?id=CVE-2025-6075
31 Oct 2025 — If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. It was discovered that Python inefficiently handled expanding system environment variables. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. Caleb Brown discovered that Python incorrectly handled the ZIP64 End of Central Directory Locator record offset value. An attacker could possibly use this issu... • https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2025-8291 – ZIP64 End of Central Directory (EOCD) Locator record offset not checked
https://notcve.org/view.php?id=CVE-2025-8291
07 Oct 2025 — The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record ma... • https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267 • CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3220 – Default mimetype known files writeable on Windows
https://notcve.org/view.php?id=CVE-2024-3220
14 Feb 2025 — There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To wor... • https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R • CWE-426: Untrusted Search Path •