---
id: CVE-2025-13836
title: >-
  When reading an HTTP response from a server, if no read amount is specified,
  the default behavior will be to use Content-Length
summary: >-
  When reading an HTTP response from a server, if no read amount is specified,
  the default behavior will be to use Content-Length. This allows a malicious
  server to cause the client to read large amounts of data into memory,
  potentially ca…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: python
product: python
affected:
  - python < 3.10.20
  - 'python >= 3.11.0, < 3.11.15'
  - 'python >= 3.12.0, < 3.12.13'
  - 'python >= 3.13.0, < 3.13.11'
  - python = 3.14.0
  - python = 3.15.0
patched:
  - python 3.13.11
published: '2025-12-01'
updated: '2026-09-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13836'
references:
  - url: >-
      https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/5a4c4a033a4a54481be6870aa1896fad732555b5
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/5dc101675fd22918facbbe0fecdc821502beaaf0
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/afc40bdd3dd71f343fd9016f6d8eebbacbd6587c
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/119451'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/119454'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/OQ6G7MKRQIS3OAREC3HNG3D2DPOU34XO/
    label: cna@python.org
tags:
  - nvd
epss: 0.01631
epssPercentile: 0.75181
ingestedAt: '2026-09-03T03:55:23.777Z'
---

## Overview

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

## Affected

- `python < 3.10.20`
- `python >= 3.11.0, < 3.11.15`
- `python >= 3.12.0, < 3.12.13`
- `python >= 3.13.0, < 3.13.11`
- `python = 3.14.0`
- `python = 3.15.0`

## Remediation

Upgrade past the affected range:

- `python 3.13.11`